[Qemu-devel] Re: [PATCH] savevm: fix corruption in vmstate_subsection_load().

[Paolo Bonzini <pbonzini@redhat.com>]

On 12/14/2010 10:07 AM, Yoshiaki Tamura wrote:
> Although it's rare to happen in live migration, when the head of a
> byte stream contains 0x05

IIUC, this happens if you have VMS_STRUCT and the field after the 
VMS_STRUCT starts with 0x5.

I think you should also add this in vmstate_subsection_load:

     sub_vmsd = vmstate_get_subsection(sub, idstr);
     if (sub_vmsd == NULL) {
         return -ENOENT;
     }
+   assert (!sub_vmsd->subsections);
     ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);

and this in vmstate_load_state:

     if (field->flags & VMS_STRUCT) {
+       assert (!vmsd->subsections);
         ret = vmstate_load_state(f, field->vmsd, addr,
                                  field->vmsd->version_id);
     }

Paolo