2.6.28-rc3: usb_hcd_poll_rh_status: array subscript is above array bounds

2.6.28-rc3: usb_hcd_poll_rh_status: array subscript is above array bounds

[Andrey Borzenkov]

[-- Attachment #1: Type: text/plain, Size: 335 bytes --]

  CC [M]  drivers/usb/core/hcd.o
/home/bor/src/linux-git/drivers/usb/core/hcd.c: In function ‘usb_hcd_poll_rh_status’:
/home/bor/src/linux-git/arch/x86/include/asm/string_32.h:75: warning: array subscript is above array bounds

It is likely that issue is actually in string_32.h as similar errors are
in oher places as well.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: 2.6.28-rc3: usb_hcd_poll_rh_status: array subscript is above array bounds

[Alan Stern]

On Mon, 3 Nov 2008, Andrey Borzenkov wrote:

>   CC [M]  drivers/usb/core/hcd.o
> /home/bor/src/linux-git/drivers/usb/core/hcd.c: In function ‘usb_hcd_poll_rh_status’:
> /home/bor/src/linux-git/arch/x86/include/asm/string_32.h:75: warning: array subscript is above array bounds
> 
> It is likely that issue is actually in string_32.h as similar errors are
> in oher places as well.

I think this is actually a compiler bug.  It certainly has nothing to
do with USB.  There was a discussion about it a month or so ago on
LKML.

Alan Stern

Re: 2.6.28-rc3: usb_hcd_poll_rh_status: array subscript is above array bounds

[Andrey Borzenkov]

[-- Attachment #1: Type: text/plain, Size: 1048 bytes --]

On Monday 03 November 2008, Alan Stern wrote:
> On Mon, 3 Nov 2008, Andrey Borzenkov wrote:
> 
> >   CC [M]  drivers/usb/core/hcd.o
> > /home/bor/src/linux-git/drivers/usb/core/hcd.c: In function ‘usb_hcd_poll_rh_status’:
> > /home/bor/src/linux-git/arch/x86/include/asm/string_32.h:75: warning: array subscript is above array bounds
> > 
> > It is likely that issue is actually in string_32.h as similar errors are
> > in oher places as well.
> 
> I think this is actually a compiler bug.  It certainly has nothing to
> do with USB.  There was a discussion about it a month or so ago on
> LKML.
> 



Yes this really looks like a compiler bug, "length" hardly can be considered
constant expression even using very broad definition of "constant".

What is interesting though, it appears that compiler believes length has
value of 5. So it will copy one extra byte; and possibly pass incorrect
length to the caller. I cannot judge whether this garbage can do any harm.

Dp you know if it was ever reported to gcc folks?

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: 2.6.28-rc3: usb_hcd_poll_rh_status: array subscript is above array bounds

[Alan Stern]

On Tue, 4 Nov 2008, Andrey Borzenkov wrote:

> > I think this is actually a compiler bug.  It certainly has nothing to
> > do with USB.  There was a discussion about it a month or so ago on
> > LKML.
> > 
> 
> 
> 
> Yes this really looks like a compiler bug, "length" hardly can be considered
> constant expression even using very broad definition of "constant".
> 
> What is interesting though, it appears that compiler believes length has
> value of 5. So it will copy one extra byte; and possibly pass incorrect
> length to the caller. I cannot judge whether this garbage can do any harm.

Did you examine the object code?  That's the only way to be sure.

> Dp you know if it was ever reported to gcc folks?

I have no idea.  All I know is what was reported on LKML.

Alan Stern

Re: 2.6.28-rc3: usb_hcd_poll_rh_status: array subscript is above array bounds

[Arjan van de Ven]

On Tue, 4 Nov 2008 11:10:33 -0500 (EST)
Alan Stern <stern@rowland.harvard.edu> wrote:

> > Dp you know if it was ever reported to gcc folks?
> 
> I have no idea.  All I know is what was reported on LKML.

I reported this bug (well from a different part of the kernel, but same
warning) to gcc and yes it's a "gcc behavior"
apparently they produce the warning in a phase of the compiler before
the optimization to remove this code as "not taken".

There's a fix floating around but it's only a partial fix or something
like that.


-- 
Arjan van de Ven 	Intel Open Source Technology Centre
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org