[Qemu-devel] Re: [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load().

[Juan Quintela <quintela@redhat.com>]

Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp> wrote:
> Although it's rare to happen in live migration, when the head of a
> byte stream contains 0x05 which is the marker of subsection, the
> loader gets corrupted because vmstate_subsection_load() continues even
> the device doesn't require it.  This patch adds a checker whether
> subsection is needed, and skips following routines if not needed.

This only fixes "partially" the problem :(

I agree with bonzini that it is better than what we had until we get the
time to try a better aproach.  I was thinking about only allowing
subsections at the top level, but that still don't improve things, would
have to think more about the problem.

Reviewed-by: Juan Quintela <quintela@redhat.com>

> Signed-off-by: Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  savevm.c |   10 +++++++++-
>  1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/savevm.c b/savevm.c
> index 4453217..6d83b0f 100644
> --- a/savevm.c
> +++ b/savevm.c
> @@ -1638,6 +1638,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection
>  static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>                                     void *opaque)
>  {
> +    const VMStateSubsection *sub = vmsd->subsections;
> +
> +    if (!sub || !sub->needed) {
> +        return 0;
> +    }
> +
>      while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) {
>          char idstr[256];
>          int ret;
> @@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>          idstr[len] = 0;
>          version_id = qemu_get_be32(f);
>  
> -        sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);
> +        sub_vmsd = vmstate_get_subsection(sub, idstr);
>          if (sub_vmsd == NULL) {
>              return -ENOENT;
>          }
> +        assert(!sub_vmsd->subsections);
>          ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
>          if (ret) {
>              return ret;
> @@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
>              qemu_put_byte(f, len);
>              qemu_put_buffer(f, (uint8_t *)vmsd->name, len);
>              qemu_put_be32(f, vmsd->version_id);
> +            assert(!vmsd->subsections);
>              vmstate_save_state(f, vmsd, opaque);
>          }
>          sub++;