From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59584) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X9c6d-0006UF-LQ for qemu-devel@nongnu.org; Tue, 22 Jul 2014 11:36:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X9c6W-00073K-5e for qemu-devel@nongnu.org; Tue, 22 Jul 2014 11:35:55 -0400 Date: Tue, 22 Jul 2014 21:05:02 +0530 From: Amit Shah Message-ID: <20140722153502.GG32103@grmbl.mre> References: <1406042801-28212-1-git-send-email-lersek@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1406042801-28212-1-git-send-email-lersek@redhat.com> Subject: Re: [Qemu-devel] [PATCH for-2.1 for-stable] vmstate_xhci_event: fix unterminated field list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Laszlo Ersek Cc: qemu-devel@nongnu.org, qemu-stable@nongnu.org, Juan Quintela , dgilbert@redhat.com, kraxel@redhat.com On (Tue) 22 Jul 2014 [17:26:41], Laszlo Ersek wrote: > "vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live > migration support"), and first released in v1.6.0. The field list in this > VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. > > During normal use (ie. migration), the issue is practically invisible, > because the "vmstate_xhci_event" object (with the unterminated field list) > is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() > returns true, for the "ev_buffer" test. Since that field_exists() check > (apparently) almost always returns false, we almost never traverse > "vmstate_xhci_event" during migration, which hides the bug. > > However, Amit's vmstate checker forces recursion into this VMSD as well, > and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator > check (field->name != NULL) in dump_vmstate_vmsd(). The result is > undefined behavior, which in my case translates to infinite recursion > (because the loop happens to overflow into "vmstate_xhci_intr", which then > links back to "vmstate_xhci_event"). > > Add the missing terminator. > > Signed-off-by: Laszlo Ersek Thanks for spotting this! Reviewed-by: Amit Shah Amit