[Qemu-devel] [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load().

[Qemu-devel] [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load().

[Yoshiaki Tamura]

Although it's rare to happen in live migration, when the head of a
byte stream contains 0x05 which is the marker of subsection, the
loader gets corrupted because vmstate_subsection_load() continues even
the device doesn't require it.  This patch adds a checker whether
subsection is needed, and skips following routines if not needed.

Signed-off-by: Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
---
 savevm.c |   10 +++++++++-
 1 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/savevm.c b/savevm.c
index 4453217..6d83b0f 100644
--- a/savevm.c
+++ b/savevm.c
@@ -1638,6 +1638,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection
 static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
                                    void *opaque)
 {
+    const VMStateSubsection *sub = vmsd->subsections;
+
+    if (!sub || !sub->needed) {
+        return 0;
+    }
+
     while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) {
         char idstr[256];
         int ret;
@@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
         idstr[len] = 0;
         version_id = qemu_get_be32(f);
 
-        sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);
+        sub_vmsd = vmstate_get_subsection(sub, idstr);
         if (sub_vmsd == NULL) {
             return -ENOENT;
         }
+        assert(!sub_vmsd->subsections);
         ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
         if (ret) {
             return ret;
@@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
             qemu_put_byte(f, len);
             qemu_put_buffer(f, (uint8_t *)vmsd->name, len);
             qemu_put_be32(f, vmsd->version_id);
+            assert(!vmsd->subsections);
             vmstate_save_state(f, vmsd, opaque);
         }
         sub++;
-- 
1.7.1.2

[Qemu-devel] Re: [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load().

[Juan Quintela]

Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp> wrote:
> Although it's rare to happen in live migration, when the head of a
> byte stream contains 0x05 which is the marker of subsection, the
> loader gets corrupted because vmstate_subsection_load() continues even
> the device doesn't require it.  This patch adds a checker whether
> subsection is needed, and skips following routines if not needed.

This only fixes "partially" the problem :(

I agree with bonzini that it is better than what we had until we get the
time to try a better aproach.  I was thinking about only allowing
subsections at the top level, but that still don't improve things, would
have to think more about the problem.

Reviewed-by: Juan Quintela <quintela@redhat.com>

> Signed-off-by: Yoshiaki Tamura <tamura.yoshiaki@lab.ntt.co.jp>
> Acked-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>  savevm.c |   10 +++++++++-
>  1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/savevm.c b/savevm.c
> index 4453217..6d83b0f 100644
> --- a/savevm.c
> +++ b/savevm.c
> @@ -1638,6 +1638,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection
>  static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>                                     void *opaque)
>  {
> +    const VMStateSubsection *sub = vmsd->subsections;
> +
> +    if (!sub || !sub->needed) {
> +        return 0;
> +    }
> +
>      while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) {
>          char idstr[256];
>          int ret;
> @@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>          idstr[len] = 0;
>          version_id = qemu_get_be32(f);
>  
> -        sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);
> +        sub_vmsd = vmstate_get_subsection(sub, idstr);
>          if (sub_vmsd == NULL) {
>              return -ENOENT;
>          }
> +        assert(!sub_vmsd->subsections);
>          ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
>          if (ret) {
>              return ret;
> @@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
>              qemu_put_byte(f, len);
>              qemu_put_buffer(f, (uint8_t *)vmsd->name, len);
>              qemu_put_be32(f, vmsd->version_id);
> +            assert(!vmsd->subsections);
>              vmstate_save_state(f, vmsd, opaque);
>          }
>          sub++;

Re: [Qemu-devel] [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load().

[Anthony Liguori]

On 02/02/2011 10:34 PM, Yoshiaki Tamura wrote:
> Although it's rare to happen in live migration, when the head of a
> byte stream contains 0x05 which is the marker of subsection, the
> loader gets corrupted because vmstate_subsection_load() continues even
> the device doesn't require it.  This patch adds a checker whether
> subsection is needed, and skips following routines if not needed.
>
> Signed-off-by: Yoshiaki Tamura<tamura.yoshiaki@lab.ntt.co.jp>
> Acked-by: Paolo Bonzini<pbonzini@redhat.com>
>    

Applied to master, Thanks.

Regards,

Anthony Liguori

> ---
>   savevm.c |   10 +++++++++-
>   1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/savevm.c b/savevm.c
> index 4453217..6d83b0f 100644
> --- a/savevm.c
> +++ b/savevm.c
> @@ -1638,6 +1638,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection
>   static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>                                      void *opaque)
>   {
> +    const VMStateSubsection *sub = vmsd->subsections;
> +
> +    if (!sub || !sub->needed) {
> +        return 0;
> +    }
> +
>       while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) {
>           char idstr[256];
>           int ret;
> @@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
>           idstr[len] = 0;
>           version_id = qemu_get_be32(f);
>
> -        sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);
> +        sub_vmsd = vmstate_get_subsection(sub, idstr);
>           if (sub_vmsd == NULL) {
>               return -ENOENT;
>           }
> +        assert(!sub_vmsd->subsections);
>           ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
>           if (ret) {
>               return ret;
> @@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
>               qemu_put_byte(f, len);
>               qemu_put_buffer(f, (uint8_t *)vmsd->name, len);
>               qemu_put_be32(f, vmsd->version_id);
> +            assert(!vmsd->subsections);
>               vmstate_save_state(f, vmsd, opaque);
>           }
>           sub++;
>