From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Cooper Subject: Re: [PATCH] fix segfault in xl migrate --debug Date: Wed, 26 Nov 2014 21:19:04 +0000 Message-ID: <547643C8.5000806@citrix.com> References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6197980008294630126==" Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: M A Young , xen-devel@lists.xen.org Cc: Ian Jackson , Wei Liu , Ian Campbell , Stefano Stabellini List-Id: xen-devel@lists.xenproject.org This is a multi-part message in MIME format. --===============6197980008294630126== Content-Type: multipart/alternative; boundary="------------020307050008070504090507" This is a multi-part message in MIME format. --------------020307050008070504090507 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 26/11/2014 19:54, M A Young wrote: > If differences are found during the verification phase of xl migrate > --debug then it is likely to crash with a segfault because the bogus > pagebuf->pfn_types[pfn] is used in a print statement instead of > pfn_type[pfn] . > > Signed-off-by: Michael Young > > Reviewed-by: Andrew Cooper > xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is > used in a print statement instead of pfn_type[pfn] > > --- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig 2014-10-24 15:22:40.000000000 +0100 > +++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c 2014-11-25 21:01:16.604081467 +0000 > @@ -1404,7 +1404,7 @@ > int v; > > DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx " > - "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn], > + "actualcs=%08lx\n", pfn, pfn_type[pfn], > csum_page(region_base + i * PAGE_SIZE), > csum_page(buf)); > --------------020307050008070504090507 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

On 26/11/2014 19:54, M A Young wrote:

If differences are found during the verification phase of xl migrate --debug then it is likely to crash with a segfault because the bogus
pagebuf->pfn_types[pfn] is used in a print statement instead of pfn_type[pfn] .

Signed-off-by: Michael Young <m.a.young@durham.ac.uk>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is
used in a print statement instead of pfn_type[pfn] 

--- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig	2014-10-24 15:22:40.000000000 +0100
+++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c	2014-11-25 21:01:16.604081467 +0000
@@ -1404,7 +1404,7 @@
                 int v;
 
                 DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx "
-                        "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn],
+                        "actualcs=%08lx\n", pfn, pfn_type[pfn],
                         csum_page(region_base + i * PAGE_SIZE),
                         csum_page(buf));

--------------020307050008070504090507-- --===============6197980008294630126== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xen.org http://lists.xen.org/xen-devel --===============6197980008294630126==--