* [Qemu-devel] [PATCH] migration: fix live migration failure with compression @ 2016-08-09 0:22 Liang Li 2016-08-09 15:46 ` Dr. David Alan Gilbert 0 siblings, 1 reply; 6+ messages in thread From: Liang Li @ 2016-08-09 0:22 UTC (permalink / raw) To: qemu-devel; +Cc: quintela, amit.shah, dgilbert, berrange, Liang Li Because of commit 11808bb0c422, which remove some condition checks of 'f->ops->writev_buffer', 'qemu_put_qemu_file' should be enhanced to clear the 'f_src->iovcnt', or 'f_src->iovcnt' may exceed the MAX_IOV_SIZE which will break live migration. This should be fixed. Signed-off-by: Liang Li <liang.z.li@intel.com> Reported-by: Jinshi Zhang <jinshi.c.zhang@intel.com> --- migration/qemu-file.c | 1 + 1 file changed, 1 insertion(+) diff --git a/migration/qemu-file.c b/migration/qemu-file.c index bbc565e..e9fae31 100644 --- a/migration/qemu-file.c +++ b/migration/qemu-file.c @@ -668,6 +668,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, QEMUFile *f_src) len = f_src->buf_index; qemu_put_buffer(f_des, f_src->buf, f_src->buf_index); f_src->buf_index = 0; + f_src->iovcnt = 0; } return len; } -- 1.9.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] migration: fix live migration failure with compression 2016-08-09 0:22 [Qemu-devel] [PATCH] migration: fix live migration failure with compression Liang Li @ 2016-08-09 15:46 ` Dr. David Alan Gilbert 2016-08-10 6:16 ` Li, Liang Z 0 siblings, 1 reply; 6+ messages in thread From: Dr. David Alan Gilbert @ 2016-08-09 15:46 UTC (permalink / raw) To: Liang Li; +Cc: qemu-devel, quintela, amit.shah, berrange * Liang Li (liang.z.li@intel.com) wrote: > Because of commit 11808bb0c422, which remove some condition checks > of 'f->ops->writev_buffer', 'qemu_put_qemu_file' should be enhanced > to clear the 'f_src->iovcnt', or 'f_src->iovcnt' may exceed the > MAX_IOV_SIZE which will break live migration. This should be fixed. > > Signed-off-by: Liang Li <liang.z.li@intel.com> > Reported-by: Jinshi Zhang <jinshi.c.zhang@intel.com> > --- > migration/qemu-file.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/migration/qemu-file.c b/migration/qemu-file.c > index bbc565e..e9fae31 100644 > --- a/migration/qemu-file.c > +++ b/migration/qemu-file.c > @@ -668,6 +668,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, QEMUFile *f_src) > len = f_src->buf_index; > qemu_put_buffer(f_des, f_src->buf, f_src->buf_index); > f_src->buf_index = 0; > + f_src->iovcnt = 0; > } If you're just using the buf[] in the src, how does it end up incrementing the iovcnt? Dave > return len; > } > -- > 1.9.1 > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] migration: fix live migration failure with compression 2016-08-09 15:46 ` Dr. David Alan Gilbert @ 2016-08-10 6:16 ` Li, Liang Z 2016-08-10 17:58 ` Dr. David Alan Gilbert 0 siblings, 1 reply; 6+ messages in thread From: Li, Liang Z @ 2016-08-10 6:16 UTC (permalink / raw) To: Dr. David Alan Gilbert Cc: qemu-devel@nongnu.org, quintela@redhat.com, amit.shah@redhat.com, berrange@redhat.com > Subject: Re: [PATCH] migration: fix live migration failure with compression > > * Liang Li (liang.z.li@intel.com) wrote: > > Because of commit 11808bb0c422, which remove some condition checks of > > 'f->ops->writev_buffer', 'qemu_put_qemu_file' should be enhanced to > > clear the 'f_src->iovcnt', or 'f_src->iovcnt' may exceed the > > MAX_IOV_SIZE which will break live migration. This should be fixed. > > > > Signed-off-by: Liang Li <liang.z.li@intel.com> > > Reported-by: Jinshi Zhang <jinshi.c.zhang@intel.com> > > --- > > migration/qemu-file.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/migration/qemu-file.c b/migration/qemu-file.c index > > bbc565e..e9fae31 100644 > > --- a/migration/qemu-file.c > > +++ b/migration/qemu-file.c > > @@ -668,6 +668,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, > QEMUFile *f_src) > > len = f_src->buf_index; > > qemu_put_buffer(f_des, f_src->buf, f_src->buf_index); > > f_src->buf_index = 0; > > + f_src->iovcnt = 0; > > } > > If you're just using the buf[] in the src, how does it end up incrementing the > iovcnt? > > Dave > > > return len; > > } 'qemu_put_be32' is used to put some data to an allocated 'f_src'. Before the 11808bb0c422, this operation won't increase the 'f_src->iovcnt', there is no issue. Commit 11808bb0c422 remove the checking of 'f->ops->writev_buffer', now 'qemu_put_be32' will increase 'f_src->iovcnt' and set 'f_src->iov []', once the 'f_src->iovcnt' reach to MAX_IOV_SIZE, 'qemu_fflush' will be trigged. Beacause 'f_src' is not writeable, 'qemu_fflsh' will return without wrapping around 'f_src->iovcnt' , the following 'qemu_put_be32' on 'f_src' will increase 'f_src->iovcnt' and make it exceed MAX_IOV_SIZE, then set 'f_src->iov[]' will corrupt memory. Liang ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] migration: fix live migration failure with compression 2016-08-10 6:16 ` Li, Liang Z @ 2016-08-10 17:58 ` Dr. David Alan Gilbert 2016-08-11 4:37 ` Amit Shah 0 siblings, 1 reply; 6+ messages in thread From: Dr. David Alan Gilbert @ 2016-08-10 17:58 UTC (permalink / raw) To: Li, Liang Z Cc: qemu-devel@nongnu.org, quintela@redhat.com, amit.shah@redhat.com, berrange@redhat.com, peter.maydell * Li, Liang Z (liang.z.li@intel.com) wrote: > > Subject: Re: [PATCH] migration: fix live migration failure with compression > > > > * Liang Li (liang.z.li@intel.com) wrote: > > > Because of commit 11808bb0c422, which remove some condition checks of > > > 'f->ops->writev_buffer', 'qemu_put_qemu_file' should be enhanced to > > > clear the 'f_src->iovcnt', or 'f_src->iovcnt' may exceed the > > > MAX_IOV_SIZE which will break live migration. This should be fixed. > > > > > > Signed-off-by: Liang Li <liang.z.li@intel.com> > > > Reported-by: Jinshi Zhang <jinshi.c.zhang@intel.com> > > > --- > > > migration/qemu-file.c | 1 + > > > 1 file changed, 1 insertion(+) > > > > > > diff --git a/migration/qemu-file.c b/migration/qemu-file.c index > > > bbc565e..e9fae31 100644 > > > --- a/migration/qemu-file.c > > > +++ b/migration/qemu-file.c > > > @@ -668,6 +668,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, > > QEMUFile *f_src) > > > len = f_src->buf_index; > > > qemu_put_buffer(f_des, f_src->buf, f_src->buf_index); > > > f_src->buf_index = 0; > > > + f_src->iovcnt = 0; > > > } > > > > If you're just using the buf[] in the src, how does it end up incrementing the > > iovcnt? > > > > Dave > > > > > return len; > > > } > > 'qemu_put_be32' is used to put some data to an allocated 'f_src'. Before the 11808bb0c422, this operation > won't increase the 'f_src->iovcnt', there is no issue. > Commit 11808bb0c422 remove the checking of 'f->ops->writev_buffer', > now 'qemu_put_be32' will increase 'f_src->iovcnt' and set 'f_src->iov []', once the 'f_src->iovcnt' reach to > MAX_IOV_SIZE, 'qemu_fflush' will be trigged. Beacause 'f_src' is not writeable, 'qemu_fflsh' will return > without wrapping around 'f_src->iovcnt' , the following 'qemu_put_be32' on 'f_src' will increase 'f_src->iovcnt' > and make it exceed MAX_IOV_SIZE, then set 'f_src->iov[]' will corrupt memory. OK, thanks Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Amit, Peter: I think this is one for 2.7 because I think that's a regression given that the 11808bb0c422 referenced is after 2.6. Dave > Liang > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] migration: fix live migration failure with compression 2016-08-10 17:58 ` Dr. David Alan Gilbert @ 2016-08-11 4:37 ` Amit Shah 2016-08-11 8:03 ` Dr. David Alan Gilbert 0 siblings, 1 reply; 6+ messages in thread From: Amit Shah @ 2016-08-11 4:37 UTC (permalink / raw) To: Dr. David Alan Gilbert Cc: Li, Liang Z, qemu-devel@nongnu.org, quintela@redhat.com, berrange@redhat.com, peter.maydell On (Wed) 10 Aug 2016 [18:58:21], Dr. David Alan Gilbert wrote: > * Li, Liang Z (liang.z.li@intel.com) wrote: > > > Subject: Re: [PATCH] migration: fix live migration failure with compression > > > > > > * Liang Li (liang.z.li@intel.com) wrote: > > > > Because of commit 11808bb0c422, which remove some condition checks of > > > > 'f->ops->writev_buffer', 'qemu_put_qemu_file' should be enhanced to > > > > clear the 'f_src->iovcnt', or 'f_src->iovcnt' may exceed the > > > > MAX_IOV_SIZE which will break live migration. This should be fixed. > > > > > > > > Signed-off-by: Liang Li <liang.z.li@intel.com> > > > > Reported-by: Jinshi Zhang <jinshi.c.zhang@intel.com> > > > > --- > > > > migration/qemu-file.c | 1 + > > > > 1 file changed, 1 insertion(+) > > > > > > > > diff --git a/migration/qemu-file.c b/migration/qemu-file.c index > > > > bbc565e..e9fae31 100644 > > > > --- a/migration/qemu-file.c > > > > +++ b/migration/qemu-file.c > > > > @@ -668,6 +668,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, > > > QEMUFile *f_src) > > > > len = f_src->buf_index; > > > > qemu_put_buffer(f_des, f_src->buf, f_src->buf_index); > > > > f_src->buf_index = 0; > > > > + f_src->iovcnt = 0; > > > > } > > > > > > If you're just using the buf[] in the src, how does it end up incrementing the > > > iovcnt? > > > > > > Dave > > > > > > > return len; > > > > } > > > > 'qemu_put_be32' is used to put some data to an allocated 'f_src'. Before the 11808bb0c422, this operation > > won't increase the 'f_src->iovcnt', there is no issue. > > Commit 11808bb0c422 remove the checking of 'f->ops->writev_buffer', > > now 'qemu_put_be32' will increase 'f_src->iovcnt' and set 'f_src->iov []', once the 'f_src->iovcnt' reach to > > MAX_IOV_SIZE, 'qemu_fflush' will be trigged. Beacause 'f_src' is not writeable, 'qemu_fflsh' will return > > without wrapping around 'f_src->iovcnt' , the following 'qemu_put_be32' on 'f_src' will increase 'f_src->iovcnt' > > and make it exceed MAX_IOV_SIZE, then set 'f_src->iov[]' will corrupt memory. > > OK, thanks > > Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Did you mean to Reviewed-by? > Amit, Peter: I think this is one for 2.7 because I think that's a regression > given that the 11808bb0c422 referenced is after 2.6. I'll send it out, thanks. Amit ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH] migration: fix live migration failure with compression 2016-08-11 4:37 ` Amit Shah @ 2016-08-11 8:03 ` Dr. David Alan Gilbert 0 siblings, 0 replies; 6+ messages in thread From: Dr. David Alan Gilbert @ 2016-08-11 8:03 UTC (permalink / raw) To: Amit Shah Cc: Li, Liang Z, qemu-devel@nongnu.org, quintela@redhat.com, berrange@redhat.com, peter.maydell * Amit Shah (amit.shah@redhat.com) wrote: > On (Wed) 10 Aug 2016 [18:58:21], Dr. David Alan Gilbert wrote: > > * Li, Liang Z (liang.z.li@intel.com) wrote: > > > > Subject: Re: [PATCH] migration: fix live migration failure with compression > > > > > > > > * Liang Li (liang.z.li@intel.com) wrote: > > > > > Because of commit 11808bb0c422, which remove some condition checks of > > > > > 'f->ops->writev_buffer', 'qemu_put_qemu_file' should be enhanced to > > > > > clear the 'f_src->iovcnt', or 'f_src->iovcnt' may exceed the > > > > > MAX_IOV_SIZE which will break live migration. This should be fixed. > > > > > > > > > > Signed-off-by: Liang Li <liang.z.li@intel.com> > > > > > Reported-by: Jinshi Zhang <jinshi.c.zhang@intel.com> > > > > > --- > > > > > migration/qemu-file.c | 1 + > > > > > 1 file changed, 1 insertion(+) > > > > > > > > > > diff --git a/migration/qemu-file.c b/migration/qemu-file.c index > > > > > bbc565e..e9fae31 100644 > > > > > --- a/migration/qemu-file.c > > > > > +++ b/migration/qemu-file.c > > > > > @@ -668,6 +668,7 @@ int qemu_put_qemu_file(QEMUFile *f_des, > > > > QEMUFile *f_src) > > > > > len = f_src->buf_index; > > > > > qemu_put_buffer(f_des, f_src->buf, f_src->buf_index); > > > > > f_src->buf_index = 0; > > > > > + f_src->iovcnt = 0; > > > > > } > > > > > > > > If you're just using the buf[] in the src, how does it end up incrementing the > > > > iovcnt? > > > > > > > > Dave > > > > > > > > > return len; > > > > > } > > > > > > 'qemu_put_be32' is used to put some data to an allocated 'f_src'. Before the 11808bb0c422, this operation > > > won't increase the 'f_src->iovcnt', there is no issue. > > > Commit 11808bb0c422 remove the checking of 'f->ops->writev_buffer', > > > now 'qemu_put_be32' will increase 'f_src->iovcnt' and set 'f_src->iov []', once the 'f_src->iovcnt' reach to > > > MAX_IOV_SIZE, 'qemu_fflush' will be trigged. Beacause 'f_src' is not writeable, 'qemu_fflsh' will return > > > without wrapping around 'f_src->iovcnt' , the following 'qemu_put_be32' on 'f_src' will increase 'f_src->iovcnt' > > > and make it exceed MAX_IOV_SIZE, then set 'f_src->iov[]' will corrupt memory. > > > > OK, thanks > > > > Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> > > Did you mean to Reviewed-by? Oops! Yes, Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> > > Amit, Peter: I think this is one for 2.7 because I think that's a regression > > given that the 11808bb0c422 referenced is after 2.6. > > I'll send it out, thanks. > > > Amit -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-08-11 8:03 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2016-08-09 0:22 [Qemu-devel] [PATCH] migration: fix live migration failure with compression Liang Li 2016-08-09 15:46 ` Dr. David Alan Gilbert 2016-08-10 6:16 ` Li, Liang Z 2016-08-10 17:58 ` Dr. David Alan Gilbert 2016-08-11 4:37 ` Amit Shah 2016-08-11 8:03 ` Dr. David Alan Gilbert
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).