Re: [PATCH] init/Kconfig: extend -Wno-array-bounds to gcc 13

[Tom Rix]

On 3/6/23 3:02 PM, Kees Cook wrote:
> On March 6, 2023 2:20:50 PM PST, Nick Desaulniers <ndesaulniers@xxxxxxxxxx> wrote:
> > + Kees
> > https://lore.kernel.org/lkml/20230306220947.1982272-1-trix@xxxxxxxxxx/
> >
> > On Mon, Mar 6, 2023 at 2:10 PM Tom Rix <trix@xxxxxxxxxx> wrote:
> > > With gcc 13.0.1 on x86, there are several false positives like
> > >
> > > drivers/net/ethernet/microchip/sparx5/sparx5_psfp.c:167:31:
> > >    error: array subscript 4 is above array bounds of ‘const struct sparx5_psfp_gce[4]’ [-Werror=array-bounds=]
> > >    167 |                 gce = &sg->gce[i];
> > >        |                        ~~~~~~~^~~
> > > In file included from drivers/net/ethernet/microchip/sparx5/sparx5_psfp.c:8:
> > > drivers/net/ethernet/microchip/sparx5/sparx5_main.h:506:32: note: while referencing ‘gce’
> > >    506 |         struct sparx5_psfp_gce gce[SPX5_PSFP_GCE_CNT];
> > >        |                                ^~~
> > >
> > > The code lines for the reported problem
> > >          /* For each scheduling entry */
> > >          for (i = 0; i < sg->num_entries; i++) {
> > >                  gce = &sg->gce[i];
> > >
> > > i is bounded by num_entries, which is set in sparx5_tc_flower.c
> > >          if (act->gate.num_entries >= SPX5_PSFP_GCE_CNT) {
> > >                  NL_SET_ERR_MSG_MOD(extack, "Invalid number of gate entries");
> > >                  return -EINVAL;
> > >          }
> > > ..
> > >          sg->num_entries = act->gate.num_entries;
> > >
> > > So disable array-bounds as was done on gcc 11 and 12
> GCC 13 isn't released yet, and we've been working to make Linux warning-free under -Wareay-bounds. (And we succeeded briefly with GCC 11.)
>
> I'd much rather get GCC fixed. This is due to the shift sanitizer reducing the scope of num_entries (via macro args) to 0-31, which is still >4. This seems like a hinting bug in GCC: just because the variable was used in a shift doesn't mean the compiler can make any value assumptions.

The build with fail generally with gcc 13.

The warnings could be cleaned without having an error, but I looked at 
multiple errors, none of them were real.

imo this is a broken compiler option.

Tom

> -Kees