From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:39199)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <guangrong.xiao@linux.intel.com>) id 1Zrd1N-00071H-3O
	for qemu-devel@nongnu.org; Wed, 28 Oct 2015 22:32:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <guangrong.xiao@linux.intel.com>) id 1Zrd1J-0005KV-Tu
	for qemu-devel@nongnu.org; Wed, 28 Oct 2015 22:32:57 -0400
Received: from mga11.intel.com ([192.55.52.93]:23841)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <guangrong.xiao@linux.intel.com>) id 1Zrd1J-0005KM-Oq
	for qemu-devel@nongnu.org; Wed, 28 Oct 2015 22:32:53 -0400
References: <1446071191-62591-1-git-send-email-guangrong.xiao@linux.intel.com>
	<1446071191-62591-31-git-send-email-guangrong.xiao@linux.intel.com>
	<20151028164818.GD1925@stefanha-x1.localdomain>
From: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Message-ID: <563183C8.8010801@linux.intel.com>
Date: Thu, 29 Oct 2015 10:26:16 +0800
MIME-Version: 1.0
In-Reply-To: <20151028164818.GD1925@stefanha-x1.localdomain>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH v5 30/33] nvdimm acpi: support Set
 Namespace Label Data function
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@redhat.com>
Cc: ehabkost@redhat.com, kvm@vger.kernel.org, mst@redhat.com, gleb@kernel.org, mtosatti@redhat.com, qemu-devel@nongnu.org, imammedo@redhat.com, pbonzini@redhat.com, dan.j.williams@intel.com, rth@twiddle.net



On 10/29/2015 12:48 AM, Stefan Hajnoczi wrote:
> On Wed, Oct 28, 2015 at 10:26:28PM +0000, Xiao Guangrong wrote:
>> +static void nvdimm_dsm_func_set_label_data(NVDIMMDevice *nvdimm,
>> +                                           nvdimm_dsm_in *in, GArray *out)
>> +{
>> +    NVDIMMClass *nvc = NVDIMM_GET_CLASS(nvdimm);
>> +    nvdimm_func_in_set_label_data *set_label_data = &in->func_set_label_data;
>> +    uint32_t status;
>> +
>> +    le32_to_cpus(&set_label_data->offset);
>> +    le32_to_cpus(&set_label_data->length);
>> +
>> +    nvdimm_debug("Write Label Data: offset %#x length %#x.\n",
>> +                 set_label_data->offset, set_label_data->length);
>> +
>> +    if (nvdimm->label_size < set_label_data->offset + set_label_data->length) {
>
> Integer overflow.
>

Will fix it too.

Really appreciate for your review, Stefan!