From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from [140.186.70.92] (port=41205 helo=eggs.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1PlL7w-0001IN-Gm for qemu-devel@nongnu.org; Fri, 04 Feb 2011 07:51:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1PlL7v-0008MW-1c for qemu-devel@nongnu.org; Fri, 04 Feb 2011 07:51:04 -0500 Received: from mail-vw0-f45.google.com ([209.85.212.45]:46350) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1PlL7u-0008MR-UJ for qemu-devel@nongnu.org; Fri, 04 Feb 2011 07:51:03 -0500 Received: by vws12 with SMTP id 12so1393605vws.4 for ; Fri, 04 Feb 2011 04:51:02 -0800 (PST) Message-ID: <4D4BF62F.4060405@codemonkey.ws> Date: Fri, 04 Feb 2011 06:50:55 -0600 From: Anthony Liguori MIME-Version: 1.0 Subject: Re: [Qemu-devel] [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load(). References: <1296707648-28191-1-git-send-email-tamura.yoshiaki@lab.ntt.co.jp> In-Reply-To: <1296707648-28191-1-git-send-email-tamura.yoshiaki@lab.ntt.co.jp> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Yoshiaki Tamura Cc: pbonzini@redhat.com, aliguori@us.ibm.com, qemu-devel@nongnu.org, quintela@redhat.com On 02/02/2011 10:34 PM, Yoshiaki Tamura wrote: > Although it's rare to happen in live migration, when the head of a > byte stream contains 0x05 which is the marker of subsection, the > loader gets corrupted because vmstate_subsection_load() continues even > the device doesn't require it. This patch adds a checker whether > subsection is needed, and skips following routines if not needed. > > Signed-off-by: Yoshiaki Tamura > Acked-by: Paolo Bonzini > Applied to master, Thanks. Regards, Anthony Liguori > --- > savevm.c | 10 +++++++++- > 1 files changed, 9 insertions(+), 1 deletions(-) > > diff --git a/savevm.c b/savevm.c > index 4453217..6d83b0f 100644 > --- a/savevm.c > +++ b/savevm.c > @@ -1638,6 +1638,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection > static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd, > void *opaque) > { > + const VMStateSubsection *sub = vmsd->subsections; > + > + if (!sub || !sub->needed) { > + return 0; > + } > + > while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) { > char idstr[256]; > int ret; > @@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd, > idstr[len] = 0; > version_id = qemu_get_be32(f); > > - sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr); > + sub_vmsd = vmstate_get_subsection(sub, idstr); > if (sub_vmsd == NULL) { > return -ENOENT; > } > + assert(!sub_vmsd->subsections); > ret = vmstate_load_state(f, sub_vmsd, opaque, version_id); > if (ret) { > return ret; > @@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd, > qemu_put_byte(f, len); > qemu_put_buffer(f, (uint8_t *)vmsd->name, len); > qemu_put_be32(f, vmsd->version_id); > + assert(!vmsd->subsections); > vmstate_save_state(f, vmsd, opaque); > } > sub++; >