Re: [PATCH nf-next 2/4] netfilter: add BUILD_BUG_ON asserts for hook array sizes

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Mon, Nov 13, 2017 at 05:41:05PM +0100, Florian Westphal wrote:
> Check that the array hooks are not accessed out-of-bounds.
> Next patch will then reduce their sizes to reflect the number
> of hooks implemented for each family.

I'm hitting this here.

In file included from ./include/linux/kernel.h:10:0,
                 from ./include/linux/uio.h:12,
                 from ./include/linux/socket.h:8,
                 from net/decnet/dn_route.c:60:
In function ‘nf_hook.constprop’,
    inlined from ‘NF_HOOK.constprop’ at
./include/linux/netfilter.h:279:6:
./include/linux/compiler.h:319:38: error: call to
‘__compiletime_assert_221’ declared with attribute error: BUILD_BUG_ON
failed: hook >= ARRAY_SIZE(net->nf.hooks_decnet)
  _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
                                      ^
./include/linux/compiler.h:299:4: note: in definition of macro
‘__compiletime_assert’
    prefix ## suffix();    \
    ^
./include/linux/compiler.h:319:2: note: in expansion of macro
‘_compiletime_assert’
  _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
  ^
./include/linux/build_bug.h:47:37: note: in expansion of macro
‘compiletime_assert’
 #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
                                     ^
./include/linux/build_bug.h:71:2: note: in expansion of macro
‘BUILD_BUG_ON_MSG’
  BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
  ^
./include/linux/netfilter.h:221:3: note: in expansion of macro
‘BUILD_BUG_ON’
   BUILD_BUG_ON(hook >= ARRAY_SIZE(net->nf.hooks_decnet));
   ^