From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47261) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adWML-0001sK-Jy for qemu-devel@nongnu.org; Wed, 09 Mar 2016 00:08:34 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1adWMI-0007tz-A3 for qemu-devel@nongnu.org; Wed, 09 Mar 2016 00:08:33 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42180) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1adWMI-0007tv-4N for qemu-devel@nongnu.org; Wed, 09 Mar 2016 00:08:30 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (Postfix) with ESMTPS id A35E93D1E9 for ; Wed, 9 Mar 2016 05:08:29 +0000 (UTC) Date: Wed, 9 Mar 2016 13:08:12 +0800 From: Peter Xu Message-ID: <20160309050812.GK2377@pxdev.xzpeter.org> References: <1457420446-25276-1-git-send-email-peterx@redhat.com> <1457420446-25276-5-git-send-email-peterx@redhat.com> <56DEC3E0.1010404@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <56DEC3E0.1010404@redhat.com> Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH 4/8] usb: fix unbounded stack for xhci_dma_write_u32s List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: qemu-devel@nongnu.org, Gerd Hoffmann On Tue, Mar 08, 2016 at 01:21:52PM +0100, Paolo Bonzini wrote: >=20 >=20 > On 08/03/2016 08:00, Peter Xu wrote: > > First of all, this function cannot be inlined even with always_inline= , > > so removing inline. >=20 > Why? always_inline fixes the error for me. I tried this patch: ----------------- diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c index 44b6f8c..961fd78 100644 --- a/hw/usb/hcd-xhci.c +++ b/hw/usb/hcd-xhci.c @@ -694,7 +694,7 @@ static inline void xhci_dma_read_u32s(XHCIState *xhci= , dma_addr_t addr, } } -static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr, +static QEMU_ARTIFICIAL void xhci_dma_write_u32s(XHCIState *xhci, dma_add= r_t addr, uint32_t *buf, size_t len) { int i; ----------------- What I got is: /root/git/qemu/hw/usb/hcd-xhci.c:699:1: warning: =E2=80=98artificial=E2=80= =99 attribute ignored [-Wattributes] { ^ /root/git/qemu/hw/usb/hcd-xhci.c:697:56: warning: always_inline function = might not be inlinable [-Wattributes] static QEMU_ARTIFICIAL void xhci_dma_write_u32s(XHCIState *xhci, dma_add= r_t addr, ^ GCC version: pxdev:bin# gcc -v Using built-in specs. COLLECT_GCC=3D/bin/gcc COLLECT_LTO_WRAPPER=3D/usr/libexec/gcc/x86_64-redhat-linux/4.8.5/lto-wrap= per Target: x86_64-redhat-linux Configured with: ../configure --prefix=3D/usr --mandir=3D/usr/share/man -= -infodir=3D/usr/share/info --with-bugurl=3Dhttp://bugzilla.redhat.com/bug= zilla --enable-bootstrap --enable-shared --enable-threads=3Dposix --enabl= e-checking=3Drelease --with-system-zlib --enable-__cxa_atexit --disable-l= ibunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id -= -with-linker-hash-style=3Dgnu --enable-languages=3Dc,c++,objc,obj-c++,jav= a,fortran,ada,go,lto --enable-plugin --enable-initfini-array --disable-li= bgcj --with-isl=3D/builddir/build/BUILD/gcc-4.8.5-20150702/obj-x86_64-red= hat-linux/isl-install --with-cloog=3D/builddir/build/BUILD/gcc-4.8.5-2015= 0702/obj-x86_64-redhat-linux/cloog-install --enable-gnu-indirect-function= --with-tune=3Dgeneric --with-arch_32=3Dx86-64 --build=3Dx86_64-redhat-li= nux Thread model: posix gcc version 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) Do you know why "might not be inlinable"? Failed to figure it out myself as mentioned in cover letter.. >=20 > > int i; > > - uint32_t tmp[len / sizeof(uint32_t)]; > > + uint32_t n =3D len / sizeof(uint32_t); > > +#define __BUF_SIZE (12) > > + uint32_t tmp[__BUF_SIZE]; > > =20 > > + assert(__BUF_SIZE >=3D n); >=20 > Instead of a #define, you can use ARRAY_SIZE(tmp). Will do when needed. Thanks! Peter