Re: [Qemu-devel] [PATCH 4/8] usb: fix unbounded stack for xhci_dma_write_u32s

[Paolo Bonzini <pbonzini@redhat.com>]

On 08/03/2016 08:00, Peter Xu wrote:
> First of all, this function cannot be inlined even with always_inline,
> so removing inline.

Why?  always_inline fixes the error for me.

>      int i;
> -    uint32_t tmp[len / sizeof(uint32_t)];
> +    uint32_t n = len / sizeof(uint32_t);
> +#define __BUF_SIZE (12)
> +    uint32_t tmp[__BUF_SIZE];
>  
> +    assert(__BUF_SIZE >= n);

Instead of a #define, you can use ARRAY_SIZE(tmp).

Paolo

>      assert((len % sizeof(uint32_t)) == 0);
>  
> -    for (i = 0; i < (len / sizeof(uint32_t)); i++) {
> +    for (i = 0; i < n; i++) {
>          tmp[i] = cpu_to_le32(buf[i]);
>      }
>      pci_dma_write(PCI_DEVICE(xhci), addr, tmp, len);
> +#undef __BUF_SIZE
>  }
>  
>  static XHCIPort *xhci_lookup_port(XHCIState *xhci, struct USBPort *uport)
>