[Qemu-devel] [PATCH] Avoid SEGV when doing migration to an FD

["Daniel P. Berrange" <berrange@redhat.com>]

From: "Daniel P. Berrange" <berrange@redhat.com>

When doing migration to an FD, a NULL 'mon' parameter
is being accessed, resulting in SEGV

* migration.c: Always set 's->mon'

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

NB, I've no idea if this is the right way to solve this,
since I haven't taken the time to identify what caused
this regression in the first place.

The stack trace was

 #0  0x000000000062a10d in monitor_get_fd (mon=0x0, fdname=0x39c6ac3 "migrate") at /home/berrange/src/virt/qemu/monitor.c:2579
 #1  0x0000000000517d53 in fd_start_outgoing_migration (s=0xa5f8e0, fdname=0x39c6ac3 "migrate") at migration-fd.c:76
 #2  0x0000000000519a7d in do_migrate (mon=0x3060430, qdict=0x39c83f0, ret_data=0x7fffa1f18ae8) at migration.c:426
 #3  0x000000000062da89 in qmp_call_cmd (mon=0x3060430, cmd=0x7a5ab0, params=0x39c83f0) at /home/berrange/src/virt/qemu/monitor.c:4636
 #4  0x000000000062dd00 in handle_qmp_command (parser=0x2f1e058, tokens=0x39a2a20) at /home/berrange/src/virt/qemu/monitor.c:4702
 #5  0x0000000000479d64 in json_message_process_token (lexer=0x2f1e060, token=0x39c5230, type=JSON_OPERATOR, x=110, y=9) at json-streamer.c:87


---
 migration.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/migration.c b/migration.c
index 4b17566..5bab86f 100644
--- a/migration.c
+++ b/migration.c
@@ -155,7 +155,6 @@ MigrationInfo *qmp_query_migrate(Error **errp)
 
 static void migrate_fd_monitor_suspend(MigrationState *s, Monitor *mon)
 {
-    s->mon = mon;
     if (monitor_suspend(mon) == 0) {
         DPRINTF("suspending monitor\n");
     } else {
@@ -383,7 +382,7 @@ static MigrationState *migrate_init(Monitor *mon, int detach, int blk, int inc)
     s->bandwidth_limit = bandwidth_limit;
     s->blk = blk;
     s->shared = inc;
-    s->mon = NULL;
+    s->mon = mon;
     s->bandwidth_limit = bandwidth_limit;
     s->state = MIG_STATE_SETUP;
 
-- 
1.7.6.4