diff mbox

[7/8] migration: fix unbounded stack for source_return_path_thread

Message ID 1457420446-25276-8-git-send-email-peterx@redhat.com
State New
Headers show

Commit Message

Peter Xu March 8, 2016, 7 a.m. UTC 
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
CC: Juan Quintela <quintela@redhat.com>
CC: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

Comments

Juan Quintela March 8, 2016, 9:48 a.m. UTC | #1 
Peter Xu <peterx@redhat.com> wrote:
> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> CC: Juan Quintela <quintela@redhat.com>
> CC: Amit Shah <amit.shah@redhat.com>
> Signed-off-by: Peter Xu <peterx@redhat.com>
> ---
>  migration/migration.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/migration/migration.c b/migration/migration.c
> index 0129d9f..f1a3976 100644
> --- a/migration/migration.c
> +++ b/migration/migration.c
> @@ -1265,11 +1265,11 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
>   */
>  static void *source_return_path_thread(void *opaque)
>  {
> +#define __MAX_LEN (512)
>      MigrationState *ms = opaque;
>      QEMUFile *rp = ms->rp_state.from_dst_file;
>      uint16_t header_len, header_type;
> -    const int max_len = 512;
> -    uint8_t buf[max_len];
> +    uint8_t buf[__MAX_LEN];
>      uint32_t tmp32, sibling_error;
>      ram_addr_t start = 0; /* =0 to silence warning */
>      size_t  len = 0, expected_len;
> @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque)
>  
>          if ((rp_cmd_args[header_type].len != -1 &&
>              header_len != rp_cmd_args[header_type].len) ||
> -            header_len > max_len) {
> +            header_len > __MAX_LEN) {
>              error_report("RP: Received '%s' message (0x%04x) with"
>                      "incorrect length %d expecting %zu",
>                      rp_cmd_args[header_type].name, header_type, header_len,
> @@ -1372,6 +1372,7 @@ out:
>      ms->rp_state.from_dst_file = NULL;
>      qemu_fclose(rp);
>      return NULL;
> +#undef __MAX_LEN
>  }
>  
>  static int open_return_path_on_source(MigrationState *ms)

Reviewed-by: Juan Quintela <quintela@redhat.com>

Do you want to push this through the migration tree or directly?
It is up to you.

Later, Juan.
Paolo Bonzini March 8, 2016, 12:26 p.m. UTC | #2 
On 08/03/2016 08:00, Peter Xu wrote:
> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> CC: Juan Quintela <quintela@redhat.com>
> CC: Amit Shah <amit.shah@redhat.com>
> Signed-off-by: Peter Xu <peterx@redhat.com>
> ---
>  migration/migration.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/migration/migration.c b/migration/migration.c
> index 0129d9f..f1a3976 100644
> --- a/migration/migration.c
> +++ b/migration/migration.c
> @@ -1265,11 +1265,11 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
>   */
>  static void *source_return_path_thread(void *opaque)
>  {
> +#define __MAX_LEN (512)
>      MigrationState *ms = opaque;
>      QEMUFile *rp = ms->rp_state.from_dst_file;
>      uint16_t header_len, header_type;
> -    const int max_len = 512;
> -    uint8_t buf[max_len];
> +    uint8_t buf[__MAX_LEN];
>      uint32_t tmp32, sibling_error;
>      ram_addr_t start = 0; /* =0 to silence warning */
>      size_t  len = 0, expected_len;
> @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque)
>  
>          if ((rp_cmd_args[header_type].len != -1 &&
>              header_len != rp_cmd_args[header_type].len) ||
> -            header_len > max_len) {
> +            header_len > __MAX_LEN) {
>              error_report("RP: Received '%s' message (0x%04x) with"
>                      "incorrect length %d expecting %zu",
>                      rp_cmd_args[header_type].name, header_type, header_len,
> @@ -1372,6 +1372,7 @@ out:
>      ms->rp_state.from_dst_file = NULL;
>      qemu_fclose(rp);
>      return NULL;
> +#undef __MAX_LEN
>  }
>  
>  static int open_return_path_on_source(MigrationState *ms)
> 

Another compiler false positive that you can fix with ARRAY_SIZE.

Paolo
Paolo Bonzini March 8, 2016, 12:27 p.m. UTC | #3 
On 08/03/2016 10:48, Juan Quintela wrote:
> Peter Xu <peterx@redhat.com> wrote:
>> Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
>> CC: Juan Quintela <quintela@redhat.com>
>> CC: Amit Shah <amit.shah@redhat.com>
>> Signed-off-by: Peter Xu <peterx@redhat.com>
>> ---
>>  migration/migration.c | 7 ++++---
>>  1 file changed, 4 insertions(+), 3 deletions(-)
>>
>> diff --git a/migration/migration.c b/migration/migration.c
>> index 0129d9f..f1a3976 100644
>> --- a/migration/migration.c
>> +++ b/migration/migration.c
>> @@ -1265,11 +1265,11 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
>>   */
>>  static void *source_return_path_thread(void *opaque)
>>  {
>> +#define __MAX_LEN (512)
>>      MigrationState *ms = opaque;
>>      QEMUFile *rp = ms->rp_state.from_dst_file;
>>      uint16_t header_len, header_type;
>> -    const int max_len = 512;
>> -    uint8_t buf[max_len];
>> +    uint8_t buf[__MAX_LEN];
>>      uint32_t tmp32, sibling_error;
>>      ram_addr_t start = 0; /* =0 to silence warning */
>>      size_t  len = 0, expected_len;
>> @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque)
>>  
>>          if ((rp_cmd_args[header_type].len != -1 &&
>>              header_len != rp_cmd_args[header_type].len) ||
>> -            header_len > max_len) {
>> +            header_len > __MAX_LEN) {
>>              error_report("RP: Received '%s' message (0x%04x) with"
>>                      "incorrect length %d expecting %zu",
>>                      rp_cmd_args[header_type].name, header_type, header_len,
>> @@ -1372,6 +1372,7 @@ out:
>>      ms->rp_state.from_dst_file = NULL;
>>      qemu_fclose(rp);
>>      return NULL;
>> +#undef __MAX_LEN
>>  }
>>  
>>  static int open_return_path_on_source(MigrationState *ms)
> 
> Reviewed-by: Juan Quintela <quintela@redhat.com>

Not really, because __ is restricted by the C standard and should not be
used in QEMU (besides the problems pointed out by other reviewers for
other patches in the series).

Paolo
Peter Xu March 9, 2016, 5:27 a.m. UTC | #4 
On Tue, Mar 08, 2016 at 01:26:24PM +0100, Paolo Bonzini wrote:
> 
> 
> On 08/03/2016 08:00, Peter Xu wrote:
> > Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
> > CC: Juan Quintela <quintela@redhat.com>
> > CC: Amit Shah <amit.shah@redhat.com>
> > Signed-off-by: Peter Xu <peterx@redhat.com>
> > ---
> >  migration/migration.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/migration/migration.c b/migration/migration.c
> > index 0129d9f..f1a3976 100644
> > --- a/migration/migration.c
> > +++ b/migration/migration.c
> > @@ -1265,11 +1265,11 @@ static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
> >   */
> >  static void *source_return_path_thread(void *opaque)
> >  {
> > +#define __MAX_LEN (512)
> >      MigrationState *ms = opaque;
> >      QEMUFile *rp = ms->rp_state.from_dst_file;
> >      uint16_t header_len, header_type;
> > -    const int max_len = 512;
> > -    uint8_t buf[max_len];
> > +    uint8_t buf[__MAX_LEN];
> >      uint32_t tmp32, sibling_error;
> >      ram_addr_t start = 0; /* =0 to silence warning */
> >      size_t  len = 0, expected_len;
> > @@ -1292,7 +1292,7 @@ static void *source_return_path_thread(void *opaque)
> >  
> >          if ((rp_cmd_args[header_type].len != -1 &&
> >              header_len != rp_cmd_args[header_type].len) ||
> > -            header_len > max_len) {
> > +            header_len > __MAX_LEN) {
> >              error_report("RP: Received '%s' message (0x%04x) with"
> >                      "incorrect length %d expecting %zu",
> >                      rp_cmd_args[header_type].name, header_type, header_len,
> > @@ -1372,6 +1372,7 @@ out:
> >      ms->rp_state.from_dst_file = NULL;
> >      qemu_fclose(rp);
> >      return NULL;
> > +#undef __MAX_LEN
> >  }
> >  
> >  static int open_return_path_on_source(MigrationState *ms)
> > 
> 
> Another compiler false positive that you can fix with ARRAY_SIZE.

Yes, will fix.

Thanks.
Peter
diff mbox

Patch

diff --git a/migration/migration.c b/migration/migration.c
index 0129d9f..f1a3976 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1265,11 +1265,11 @@  static void migrate_handle_rp_req_pages(MigrationState *ms, const char* rbname,
  */
 static void *source_return_path_thread(void *opaque)
 {
+#define __MAX_LEN (512)
     MigrationState *ms = opaque;
     QEMUFile *rp = ms->rp_state.from_dst_file;
     uint16_t header_len, header_type;
-    const int max_len = 512;
-    uint8_t buf[max_len];
+    uint8_t buf[__MAX_LEN];
     uint32_t tmp32, sibling_error;
     ram_addr_t start = 0; /* =0 to silence warning */
     size_t  len = 0, expected_len;
@@ -1292,7 +1292,7 @@  static void *source_return_path_thread(void *opaque)
 
         if ((rp_cmd_args[header_type].len != -1 &&
             header_len != rp_cmd_args[header_type].len) ||
-            header_len > max_len) {
+            header_len > __MAX_LEN) {
             error_report("RP: Received '%s' message (0x%04x) with"
                     "incorrect length %d expecting %zu",
                     rp_cmd_args[header_type].name, header_type, header_len,
@@ -1372,6 +1372,7 @@  out:
     ms->rp_state.from_dst_file = NULL;
     qemu_fclose(rp);
     return NULL;
+#undef __MAX_LEN
 }
 
 static int open_return_path_on_source(MigrationState *ms)