On Wed, Nov 22, 2017 at 01:44:10PM +0100, Florian Westphal wrote: > Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > Hi Florian, > > > > On Mon, Nov 13, 2017 at 05:41:05PM +0100, Florian Westphal wrote: > > > Check that the array hooks are not accessed out-of-bounds. > > > Next patch will then reduce their sizes to reflect the number > > > of hooks implemented for each family. > > > > I'm hitting this here. > > > > In file included from ./include/linux/kernel.h:10:0, > > from ./include/linux/uio.h:12, > > from ./include/linux/socket.h:8, > > from net/decnet/dn_route.c:60: > > In function ‘nf_hook.constprop’, > > inlined from ‘NF_HOOK.constprop’ at > > ./include/linux/netfilter.h:279:6: > > ./include/linux/compiler.h:319:38: error: call to > > ‘__compiletime_assert_221’ declared with attribute error: BUILD_BUG_ON > > failed: hook >= ARRAY_SIZE(net->nf.hooks_decnet) > > _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) > > Thanks for the report, I guess gcc doesn't follow inline trail > or argument isn't known at compile time. > > I'll add a contant_p() test as well in v2. Side note: It's only happening with decnet. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
