From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH nf-next 2/4] netfilter: add BUILD_BUG_ON asserts for hook array sizes
Date: Wed, 22 Nov 2017 13:54:39 +0100 [thread overview]
Message-ID: <20171122125439.GA563@salvia> (raw)
In-Reply-To: <20171122124410.GI24866@breakpoint.cc>
On Wed, Nov 22, 2017 at 01:44:10PM +0100, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Hi Florian,
> >
> > On Mon, Nov 13, 2017 at 05:41:05PM +0100, Florian Westphal wrote:
> > > Check that the array hooks are not accessed out-of-bounds.
> > > Next patch will then reduce their sizes to reflect the number
> > > of hooks implemented for each family.
> >
> > I'm hitting this here.
> >
> > In file included from ./include/linux/kernel.h:10:0,
> > from ./include/linux/uio.h:12,
> > from ./include/linux/socket.h:8,
> > from net/decnet/dn_route.c:60:
> > In function ‘nf_hook.constprop’,
> > inlined from ‘NF_HOOK.constprop’ at
> > ./include/linux/netfilter.h:279:6:
> > ./include/linux/compiler.h:319:38: error: call to
> > ‘__compiletime_assert_221’ declared with attribute error: BUILD_BUG_ON
> > failed: hook >= ARRAY_SIZE(net->nf.hooks_decnet)
> > _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
>
> Thanks for the report, I guess gcc doesn't follow inline trail
> or argument isn't known at compile time.
>
> I'll add a contant_p() test as well in v2.
Side note: It's only happening with decnet.
next prev parent reply other threads:[~2017-11-22 12:57 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-13 16:41 [PATCH nf-next 0/4] netfilter: reduce hook sizes in struct net Florian Westphal
2017-11-13 16:41 ` [PATCH nf-next 1/4] netfilter: reduce size of hook entry point locations Florian Westphal
2017-11-13 16:41 ` [PATCH nf-next 2/4] netfilter: add BUILD_BUG_ON asserts for hook array sizes Florian Westphal
2017-11-22 12:20 ` Pablo Neira Ayuso
2017-11-22 12:44 ` Florian Westphal
2017-11-22 12:54 ` Pablo Neira Ayuso [this message]
2017-11-13 16:41 ` [PATCH nf-next 3/4] netfilter: reduce hook array sizes to what is needed Florian Westphal
2017-11-13 16:41 ` [PATCH nf-next 4/4] netfilter: add ifdefs to avoid memory waste if family is not supported Florian Westphal
2017-11-13 16:53 ` [PATCH nf-next 0/4] netfilter: reduce hook sizes in struct net Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171122125439.GA563@salvia \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).