Re: [Qemu-devel] [PATCH v2] savevm: fix corruption in vmstate_subsection_load().

[Kevin Wolf <kwolf@redhat.com>]

Am 24.01.2011 10:30, schrieb Yoshiaki Tamura:
> Although it's rare to happen in live migration, when the head of a
> byte stream contains 0x05 which is the marker of subsection, the
> loader gets corrupted because vmstate_subsection_load() continues even
> the device doesn't require it.  This patch adds a checker whether
> subsection is needed, and skips following routines if not needed.
> 
> Signed-off-by: Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
> ---
>  savevm.c |   10 +++++++++-
>  1 files changed, 9 insertions(+), 1 deletions(-)
> 
> diff --git a/savevm.c b/savevm.c
> index fcd8db4..3be875d 100644
> --- a/savevm.c
> +++ b/savevm.c
> @@ -1639,6 +1639,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection
>  static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>                                     void *opaque)
>  {
> +    const VMStateSubsection *sub = vmsd->subsections;
> +
> +    if (!sub || !sub->needed) {
> +        return 0;
> +    }

This means that subsections are silently ignored if the old version
didn't have any subsection for the device. Wasn't it a fundamental point
of the design of subsections that this would fail?

Noticed this when trying to use subsections to fix up IDE, and new ->
old migration after an I/O error only correctly fails when I revert this
patch.

Kevin