[Qemu-devel] [PATCH] Avoid SEGV when doing migration to an FD

[Qemu-devel] [PATCH] Avoid SEGV when doing migration to an FD

[Daniel P. Berrange]

From: "Daniel P. Berrange" <berrange@redhat.com>

When doing migration to an FD, a NULL 'mon' parameter
is being accessed, resulting in SEGV

* migration.c: Always set 's->mon'

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

NB, I've no idea if this is the right way to solve this,
since I haven't taken the time to identify what caused
this regression in the first place.

The stack trace was

 #0  0x000000000062a10d in monitor_get_fd (mon=0x0, fdname=0x39c6ac3 "migrate") at /home/berrange/src/virt/qemu/monitor.c:2579
 #1  0x0000000000517d53 in fd_start_outgoing_migration (s=0xa5f8e0, fdname=0x39c6ac3 "migrate") at migration-fd.c:76
 #2  0x0000000000519a7d in do_migrate (mon=0x3060430, qdict=0x39c83f0, ret_data=0x7fffa1f18ae8) at migration.c:426
 #3  0x000000000062da89 in qmp_call_cmd (mon=0x3060430, cmd=0x7a5ab0, params=0x39c83f0) at /home/berrange/src/virt/qemu/monitor.c:4636
 #4  0x000000000062dd00 in handle_qmp_command (parser=0x2f1e058, tokens=0x39a2a20) at /home/berrange/src/virt/qemu/monitor.c:4702
 #5  0x0000000000479d64 in json_message_process_token (lexer=0x2f1e060, token=0x39c5230, type=JSON_OPERATOR, x=110, y=9) at json-streamer.c:87


---
 migration.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/migration.c b/migration.c
index 4b17566..5bab86f 100644
--- a/migration.c
+++ b/migration.c
@@ -155,7 +155,6 @@ MigrationInfo *qmp_query_migrate(Error **errp)
 
 static void migrate_fd_monitor_suspend(MigrationState *s, Monitor *mon)
 {
-    s->mon = mon;
     if (monitor_suspend(mon) == 0) {
         DPRINTF("suspending monitor\n");
     } else {
@@ -383,7 +382,7 @@ static MigrationState *migrate_init(Monitor *mon, int detach, int blk, int inc)
     s->bandwidth_limit = bandwidth_limit;
     s->blk = blk;
     s->shared = inc;
-    s->mon = NULL;
+    s->mon = mon;
     s->bandwidth_limit = bandwidth_limit;
     s->state = MIG_STATE_SETUP;
 
-- 
1.7.6.4

Re: [Qemu-devel] [PATCH] Avoid SEGV when doing migration to an FD

[Anthony Liguori]

On 11/11/2011 06:44 AM, Daniel P. Berrange wrote:
> From: "Daniel P. Berrange"<berrange@redhat.com>
>
> When doing migration to an FD, a NULL 'mon' parameter
> is being accessed, resulting in SEGV
>
> * migration.c: Always set 's->mon'
>
> Signed-off-by: Daniel P. Berrange<berrange@redhat.com>
>
> NB, I've no idea if this is the right way to solve this,
> since I haven't taken the time to identify what caused
> this regression in the first place.
>
> The stack trace was
>
>   #0  0x000000000062a10d in monitor_get_fd (mon=0x0, fdname=0x39c6ac3 "migrate") at /home/berrange/src/virt/qemu/monitor.c:2579
>   #1  0x0000000000517d53 in fd_start_outgoing_migration (s=0xa5f8e0, fdname=0x39c6ac3 "migrate") at migration-fd.c:76
>   #2  0x0000000000519a7d in do_migrate (mon=0x3060430, qdict=0x39c83f0, ret_data=0x7fffa1f18ae8) at migration.c:426
>   #3  0x000000000062da89 in qmp_call_cmd (mon=0x3060430, cmd=0x7a5ab0, params=0x39c83f0) at /home/berrange/src/virt/qemu/monitor.c:4636
>   #4  0x000000000062dd00 in handle_qmp_command (parser=0x2f1e058, tokens=0x39a2a20) at /home/berrange/src/virt/qemu/monitor.c:4702
>   #5  0x0000000000479d64 in json_message_process_token (lexer=0x2f1e060, token=0x39c5230, type=JSON_OPERATOR, x=110, y=9) at json-streamer.c:87
>
>
> ---
>   migration.c |    3 +--
>   1 files changed, 1 insertions(+), 2 deletions(-)

Juan has a similar patch that he just sent out to fix this problem.  It will be 
in -rc2.

Regards,

Anthony Liguori

>
> diff --git a/migration.c b/migration.c
> index 4b17566..5bab86f 100644
> --- a/migration.c
> +++ b/migration.c
> @@ -155,7 +155,6 @@ MigrationInfo *qmp_query_migrate(Error **errp)
>
>   static void migrate_fd_monitor_suspend(MigrationState *s, Monitor *mon)
>   {
> -    s->mon = mon;
>       if (monitor_suspend(mon) == 0) {
>           DPRINTF("suspending monitor\n");
>       } else {
> @@ -383,7 +382,7 @@ static MigrationState *migrate_init(Monitor *mon, int detach, int blk, int inc)
>       s->bandwidth_limit = bandwidth_limit;
>       s->blk = blk;
>       s->shared = inc;
> -    s->mon = NULL;
> +    s->mon = mon;
>       s->bandwidth_limit = bandwidth_limit;
>       s->state = MIG_STATE_SETUP;
>