From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:50883)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peterx@redhat.com>) id 1adWf9-00049I-2Q
	for qemu-devel@nongnu.org; Wed, 09 Mar 2016 00:27:59 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <peterx@redhat.com>) id 1adWf5-00048U-SY
	for qemu-devel@nongnu.org; Wed, 09 Mar 2016 00:27:59 -0500
Received: from mx1.redhat.com ([209.132.183.28]:49360)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <peterx@redhat.com>) id 1adWf5-00048Q-NH
	for qemu-devel@nongnu.org; Wed, 09 Mar 2016 00:27:55 -0500
Received: from int-mx13.intmail.prod.int.phx2.redhat.com
	(int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26])
	by mx1.redhat.com (Postfix) with ESMTPS id 2132264D05
	for <qemu-devel@nongnu.org>; Wed,  9 Mar 2016 05:27:55 +0000 (UTC)
Date: Wed, 9 Mar 2016 13:27:43 +0800
From: Peter Xu <peterx@redhat.com>
Message-ID: <20160309052743.GO2377@pxdev.xzpeter.org>
References: <1457420446-25276-1-git-send-email-peterx@redhat.com>
	<1457420446-25276-8-git-send-email-peterx@redhat.com>
	<56DEC4F0.7010306@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <56DEC4F0.7010306@redhat.com>
Subject: Re: [Qemu-devel] [PATCH 7/8] migration: fix unbounded stack for
 source_return_path_thread
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Amit Shah <amit.shah@redhat.com>, qemu-devel@nongnu.org, Juan Quintela <quintela@redhat.com>

On Tue, Mar 08, 2016 at 01:26:24PM +0100, Paolo Bonzini wrote:
> 
> 
> On 08/03/2016 08:00, Peter Xu wrote:
> > Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> > CC: Juan Quintela <quintela@redhat.com>
> > CC: Amit Shah <amit.shah@redhat.com>
> > Signed-off-by: Peter Xu <peterx@redhat.com>
> > ---
> >  migration/migration.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/migration/migration.c b/migration/migration.c
> > index 0129d9f..f1a3976 100644
> > --- a/migration/migration.c
> > +++ b/migration/migration.c
> > @@ -1265,11 +1265,11 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
> >   */
> >  static void *source_return_path_thread(void *opaque)
> >  {
> > +#define __MAX_LEN (512)
> >      MigrationState *ms = opaque;
> >      QEMUFile *rp = ms->rp_state.from_dst_file;
> >      uint16_t header_len, header_type;
> > -    const int max_len = 512;
> > -    uint8_t buf[max_len];
> > +    uint8_t buf[__MAX_LEN];
> >      uint32_t tmp32, sibling_error;
> >      ram_addr_t start = 0; /* =0 to silence warning */
> >      size_t  len = 0, expected_len;
> > @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque)
> >  
> >          if ((rp_cmd_args[header_type].len != -1 &&
> >              header_len != rp_cmd_args[header_type].len) ||
> > -            header_len > max_len) {
> > +            header_len > __MAX_LEN) {
> >              error_report("RP: Received '%s' message (0x%04x) with"
> >                      "incorrect length %d expecting %zu",
> >                      rp_cmd_args[header_type].name, header_type, header_len,
> > @@ -1372,6 +1372,7 @@ out:
> >      ms->rp_state.from_dst_file = NULL;
> >      qemu_fclose(rp);
> >      return NULL;
> > +#undef __MAX_LEN
> >  }
> >  
> >  static int open_return_path_on_source(MigrationState *ms)
> > 
> 
> Another compiler false positive that you can fix with ARRAY_SIZE.

Yes, will fix.

Thanks.
Peter