netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* array bounds warning in xfrm_output_resume
@ 2018-06-18 18:10 David Ahern
  2018-06-19  8:11 ` Florian Westphal
  2018-09-19 16:57 ` David Ahern
  0 siblings, 2 replies; 6+ messages in thread
From: David Ahern @ 2018-06-18 18:10 UTC (permalink / raw)
  To: Florian Westphal; +Cc: netdev@vger.kernel.org

Florian:

I am seeing this warning:

$ make O=kbuild/perf -j 24 -s
In file included from /home/dsa/kernel-3.git/include/linux/kernel.h:10:0,
                 from /home/dsa/kernel-3.git/include/linux/list.h:9,
                 from /home/dsa/kernel-3.git/include/linux/module.h:9,
                 from /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c:13:
/home/dsa/kernel-3.git/net/xfrm/xfrm_output.c: In function
‘xfrm_output_resume’:
/home/dsa/kernel-3.git/include/linux/compiler.h:252:20: warning: array
subscript is above array bounds [-Warray-bounds]
   __read_once_size(&(x), __u.__c, sizeof(x));  \
                    ^~~~
/home/dsa/kernel-3.git/include/linux/compiler.h:258:22: note: in
expansion of macro ‘__READ_ONCE’
 #define READ_ONCE(x) __READ_ONCE(x, 1)
                      ^~~~~~~~~~~
/home/dsa/kernel-3.git/include/linux/rcupdate.h:350:48: note: in
expansion of macro ‘READ_ONCE’
  typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \
                                                ^~~~~~~~~
/home/dsa/kernel-3.git/include/linux/rcupdate.h:487:2: note: in
expansion of macro ‘__rcu_dereference_check’
  __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu)
  ^~~~~~~~~~~~~~~~~~~~~~~
/home/dsa/kernel-3.git/include/linux/rcupdate.h:545:28: note: in
expansion of macro ‘rcu_dereference_check’
 #define rcu_dereference(p) rcu_dereference_check(p, 0)
                            ^~~~~~~~~~~~~~~~~~~~~
/home/dsa/kernel-3.git/include/linux/netfilter.h:218:15: note: in
expansion of macro ‘rcu_dereference’
   hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
               ^~~~~~~~~~~~~~~

Line in question is the nf_hook in xfrm_output_resume.
NF_INET_POST_ROUTING = 4 which is greater than NF_ARP_NUMHOOKS = 3

I believe ef57170bbfdd6 is the commit that introduced the warning

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: array bounds warning in xfrm_output_resume
  2018-06-18 18:10 array bounds warning in xfrm_output_resume David Ahern
@ 2018-06-19  8:11 ` Florian Westphal
  2018-09-19 16:57 ` David Ahern
  1 sibling, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2018-06-19  8:11 UTC (permalink / raw)
  To: David Ahern; +Cc: Florian Westphal, netdev@vger.kernel.org

David Ahern <dsahern@gmail.com> wrote:
> $ make O=kbuild/perf -j 24 -s
> In file included from /home/dsa/kernel-3.git/include/linux/kernel.h:10:0,
>                  from /home/dsa/kernel-3.git/include/linux/list.h:9,
>                  from /home/dsa/kernel-3.git/include/linux/module.h:9,
>                  from /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c:13:
> /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c: In function
> ‘xfrm_output_resume’:
> /home/dsa/kernel-3.git/include/linux/compiler.h:252:20: warning: array
> subscript is above array bounds [-Warray-bounds]
>    __read_once_size(&(x), __u.__c, sizeof(x));  \
>                     ^~~~
> /home/dsa/kernel-3.git/include/linux/compiler.h:258:22: note: in
> expansion of macro ‘__READ_ONCE’
>  #define READ_ONCE(x) __READ_ONCE(x, 1)
>                       ^~~~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/rcupdate.h:350:48: note: in
> expansion of macro ‘READ_ONCE’
>   typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \
>                                                 ^~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/rcupdate.h:487:2: note: in
> expansion of macro ‘__rcu_dereference_check’
>   __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu)
>   ^~~~~~~~~~~~~~~~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/rcupdate.h:545:28: note: in
> expansion of macro ‘rcu_dereference_check’
>  #define rcu_dereference(p) rcu_dereference_check(p, 0)
>                             ^~~~~~~~~~~~~~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/netfilter.h:218:15: note: in
> expansion of macro ‘rcu_dereference’
>    hook_head = rcu_dereference(net->nf.hooks_arp[hook]);

Hmpf. compiler can't know that this is only called for ipv4 and
ipv6 families.

> Line in question is the nf_hook in xfrm_output_resume.
> NF_INET_POST_ROUTING = 4 which is greater than NF_ARP_NUMHOOKS = 3
> 
> I believe ef57170bbfdd6 is the commit that introduced the warning

Yes.  I will see how to best fix this, probably needs an explicit
check on skb_dst(skb)->ops->family.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: array bounds warning in xfrm_output_resume
  2018-06-18 18:10 array bounds warning in xfrm_output_resume David Ahern
  2018-06-19  8:11 ` Florian Westphal
@ 2018-09-19 16:57 ` David Ahern
  2018-09-19 17:45   ` Florian Westphal
  2018-09-20 14:06   ` Florian Westphal
  1 sibling, 2 replies; 6+ messages in thread
From: David Ahern @ 2018-09-19 16:57 UTC (permalink / raw)
  To: Florian Westphal; +Cc: netdev@vger.kernel.org

On 6/18/18 11:10 AM, David Ahern wrote:
> Florian:
> 
> I am seeing this warning:
> 
> $ make O=kbuild/perf -j 24 -s
> In file included from /home/dsa/kernel-3.git/include/linux/kernel.h:10:0,
>                  from /home/dsa/kernel-3.git/include/linux/list.h:9,
>                  from /home/dsa/kernel-3.git/include/linux/module.h:9,
>                  from /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c:13:
> /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c: In function
> ‘xfrm_output_resume’:
> /home/dsa/kernel-3.git/include/linux/compiler.h:252:20: warning: array
> subscript is above array bounds [-Warray-bounds]
>    __read_once_size(&(x), __u.__c, sizeof(x));  \
>                     ^~~~
> /home/dsa/kernel-3.git/include/linux/compiler.h:258:22: note: in
> expansion of macro ‘__READ_ONCE’
>  #define READ_ONCE(x) __READ_ONCE(x, 1)
>                       ^~~~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/rcupdate.h:350:48: note: in
> expansion of macro ‘READ_ONCE’
>   typeof(*p) *________p1 = (typeof(*p) *__force)READ_ONCE(p); \
>                                                 ^~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/rcupdate.h:487:2: note: in
> expansion of macro ‘__rcu_dereference_check’
>   __rcu_dereference_check((p), (c) || rcu_read_lock_held(), __rcu)
>   ^~~~~~~~~~~~~~~~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/rcupdate.h:545:28: note: in
> expansion of macro ‘rcu_dereference_check’
>  #define rcu_dereference(p) rcu_dereference_check(p, 0)
>                             ^~~~~~~~~~~~~~~~~~~~~
> /home/dsa/kernel-3.git/include/linux/netfilter.h:218:15: note: in
> expansion of macro ‘rcu_dereference’
>    hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
>                ^~~~~~~~~~~~~~~
> 
> Line in question is the nf_hook in xfrm_output_resume.
> NF_INET_POST_ROUTING = 4 which is greater than NF_ARP_NUMHOOKS = 3
> 
> I believe ef57170bbfdd6 is the commit that introduced the warning
> 

Hi Florian:

I am still seeing this. I realize the compiler is not understanding the
conditions properly, but it is a distraction every time I do a kernel
build on Debian Stretch having to filter the above noise from whether I
introduce another warning.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: array bounds warning in xfrm_output_resume
  2018-09-19 16:57 ` David Ahern
@ 2018-09-19 17:45   ` Florian Westphal
  2018-09-20 14:06   ` Florian Westphal
  1 sibling, 0 replies; 6+ messages in thread
From: Florian Westphal @ 2018-09-19 17:45 UTC (permalink / raw)
  To: David Ahern; +Cc: Florian Westphal, netdev@vger.kernel.org

David Ahern <dsahern@gmail.com> wrote:
> > I believe ef57170bbfdd6 is the commit that introduced the warning
> > 
> 
> Hi Florian:
> 
> I am still seeing this. I realize the compiler is not understanding the
> conditions properly, but it is a distraction every time I do a kernel
> build on Debian Stretch having to filter the above noise from whether I
> introduce another warning.

Sorry, I forgot about this.  I'll look into it tomorrow.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: array bounds warning in xfrm_output_resume
  2018-09-19 16:57 ` David Ahern
  2018-09-19 17:45   ` Florian Westphal
@ 2018-09-20 14:06   ` Florian Westphal
  2018-09-20 22:53     ` David Ahern
  1 sibling, 1 reply; 6+ messages in thread
From: Florian Westphal @ 2018-09-20 14:06 UTC (permalink / raw)
  To: David Ahern; +Cc: Florian Westphal, netdev@vger.kernel.org

David Ahern <dsahern@gmail.com> wrote:
> > $ make O=kbuild/perf -j 24 -s
> > In file included from /home/dsa/kernel-3.git/include/linux/kernel.h:10:0,
> >                  from /home/dsa/kernel-3.git/include/linux/list.h:9,
> >                  from /home/dsa/kernel-3.git/include/linux/module.h:9,
> >                  from /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c:13:
> > /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c: In function
> > ‘xfrm_output_resume’:
> > /home/dsa/kernel-3.git/include/linux/compiler.h:252:20: warning: array
> > subscript is above array bounds [-Warray-bounds]
> >    __read_once_size(&(x), __u.__c, sizeof(x));  \

Does this thing avoid the warning?

diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -143,6 +143,8 @@ int xfrm_output_resume(struct sk_buff *skb, int err)
 	struct net *net = xs_net(skb_dst(skb)->xfrm);
 
 	while (likely((err = xfrm_output_one(skb, err)) == 0)) {
+		unsigned short pf;
+
 		nf_reset(skb);
 
 		err = skb_dst(skb)->ops->local_out(net, skb->sk, skb);
@@ -152,11 +154,19 @@ int xfrm_output_resume(struct sk_buff *skb, int err)
 		if (!skb_dst(skb)->xfrm)
 			return dst_output(net, skb->sk, skb);
 
-		err = nf_hook(skb_dst(skb)->ops->family,
-			      NF_INET_POST_ROUTING, net, skb->sk, skb,
-			      NULL, skb_dst(skb)->dev, xfrm_output2);
-		if (unlikely(err != 1))
-			goto out;
+		pf = skb_dst(skb)->ops->family;
+		switch (pf) {
+		case AF_INET: /* fallthrough */
+		case AF_INET6:
+			err = nf_hook(pf,
+				      NF_INET_POST_ROUTING, net, skb->sk, skb,
+				      NULL, skb_dst(skb)->dev, xfrm_output2);
+			if (unlikely(err != 1))
+				goto out;
+			break;
+		default:
+			break;
+		}
 	}
 
 	if (err == -EINPROGRESS)

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: array bounds warning in xfrm_output_resume
  2018-09-20 14:06   ` Florian Westphal
@ 2018-09-20 22:53     ` David Ahern
  0 siblings, 0 replies; 6+ messages in thread
From: David Ahern @ 2018-09-20 22:53 UTC (permalink / raw)
  To: Florian Westphal; +Cc: netdev@vger.kernel.org

On 9/20/18 7:06 AM, Florian Westphal wrote:
> David Ahern <dsahern@gmail.com> wrote:
>>> $ make O=kbuild/perf -j 24 -s
>>> In file included from /home/dsa/kernel-3.git/include/linux/kernel.h:10:0,
>>>                  from /home/dsa/kernel-3.git/include/linux/list.h:9,
>>>                  from /home/dsa/kernel-3.git/include/linux/module.h:9,
>>>                  from /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c:13:
>>> /home/dsa/kernel-3.git/net/xfrm/xfrm_output.c: In function
>>> ‘xfrm_output_resume’:
>>> /home/dsa/kernel-3.git/include/linux/compiler.h:252:20: warning: array
>>> subscript is above array bounds [-Warray-bounds]
>>>    __read_once_size(&(x), __u.__c, sizeof(x));  \
> 
> Does this thing avoid the warning?

nope, still see it.

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2018-09-21  4:39 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-18 18:10 array bounds warning in xfrm_output_resume David Ahern
2018-06-19  8:11 ` Florian Westphal
2018-09-19 16:57 ` David Ahern
2018-09-19 17:45   ` Florian Westphal
2018-09-20 14:06   ` Florian Westphal
2018-09-20 22:53     ` David Ahern

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).