From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59712) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1advSM-0002r1-SD for qemu-devel@nongnu.org; Thu, 10 Mar 2016 02:56:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1advSH-0000D9-Kj for qemu-devel@nongnu.org; Thu, 10 Mar 2016 02:56:26 -0500 Received: from mx1.redhat.com ([209.132.183.28]:48451) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1advSH-0000Cw-FN for qemu-devel@nongnu.org; Thu, 10 Mar 2016 02:56:21 -0500 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (Postfix) with ESMTPS id EDF0019CF3B for ; Thu, 10 Mar 2016 07:56:20 +0000 (UTC) Date: Thu, 10 Mar 2016 15:56:12 +0800 From: Peter Xu Message-ID: <20160310075612.GA30354@pxdev.xzpeter.org> References: <1457575914-15581-1-git-send-email-peterx@redhat.com> <1457595253.6405.3.camel@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1457595253.6405.3.camel@redhat.com> Subject: Re: [Qemu-devel] [PATCH] usb: fix unbounded stack warning for xhci_dma_write_u32s List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: pbonzini@redhat.com, qemu-devel@nongnu.org On Thu, Mar 10, 2016 at 08:34:13AM +0100, Gerd Hoffmann wrote: > On Do, 2016-03-10 at 10:11 +0800, Peter Xu wrote: > > Signed-off-by: Peter Xu > > --- > > hw/usb/hcd-xhci.c | 6 ++++-- > > 1 file changed, 4 insertions(+), 2 deletions(-) > > > > diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c > > index 44b6f8c..d15918f 100644 > > --- a/hw/usb/hcd-xhci.c > > +++ b/hw/usb/hcd-xhci.c > > @@ -698,11 +698,13 @@ static inline void xhci_dma_write_u32s(XHCIState *xhci, dma_addr_t addr, > > uint32_t *buf, size_t len) > > { > > int i; > > - uint32_t tmp[len / sizeof(uint32_t)]; > > + uint32_t tmp[12]; > > Where does the 12 come from? As mentioned in previous thread, because all the callers of xhci_dma_write_u32s() are using const size in "len". The maximum currently is 5 * sizeof(uint32_t) = 20 bytes. Here I choose number bigger than 5 should work for now. To make it a little bit bigger, I just chose 12 with no specific reason... Since 8/12/16/... seems all works for me. Thanks. Peter