From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35271) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1X9cIo-0004fC-3b for qemu-devel@nongnu.org; Tue, 22 Jul 2014 11:48:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1X9cIh-0004Yn-Vw for qemu-devel@nongnu.org; Tue, 22 Jul 2014 11:48:30 -0400 Message-ID: <53CE87C1.5060704@redhat.com> Date: Tue, 22 Jul 2014 17:48:17 +0200 From: Laszlo Ersek MIME-Version: 1.0 References: <1406042801-28212-1-git-send-email-lersek@redhat.com> <53CE8671.4070603@redhat.com> In-Reply-To: <53CE8671.4070603@redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH for-2.1 for-stable] vmstate_xhci_event: fix unterminated field list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini , amit.shah@redhat.com, dgilbert@redhat.com, kraxel@redhat.com, qemu-devel@nongnu.org, qemu-stable@nongnu.org On 07/22/14 17:42, Paolo Bonzini wrote: > Il 22/07/2014 17:26, Laszlo Ersek ha scritto: >> "vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live >> migration support"), and first released in v1.6.0. The field list in this >> VMSD is not terminated with the VMSTATE_END_OF_LIST() macro. >> >> During normal use (ie. migration), the issue is practically invisible, >> because the "vmstate_xhci_event" object (with the unterminated field list) >> is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full() >> returns true, for the "ev_buffer" test. Since that field_exists() check >> (apparently) almost always returns false, we almost never traverse >> "vmstate_xhci_event" during migration, which hides the bug. >> >> However, Amit's vmstate checker forces recursion into this VMSD as well, >> and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator >> check (field->name != NULL) in dump_vmstate_vmsd(). The result is >> undefined behavior, which in my case translates to infinite recursion >> (because the loop happens to overflow into "vmstate_xhci_intr", which then >> links back to "vmstate_xhci_event"). >> >> Add the missing terminator. >> >> Signed-off-by: Laszlo Ersek >> --- >> hw/usb/hcd-xhci.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c >> index 7f2af89..58c4b11 100644 >> --- a/hw/usb/hcd-xhci.c >> +++ b/hw/usb/hcd-xhci.c >> @@ -3737,6 +3737,7 @@ static const VMStateDescription vmstate_xhci_event = { >> VMSTATE_UINT32(flags, XHCIEvent), >> VMSTATE_UINT8(slotid, XHCIEvent), >> VMSTATE_UINT8(epid, XHCIEvent), >> + VMSTATE_END_OF_LIST() >> } >> }; >> >> > > Cc: qemu-stable@nongnu.org As far as I can see, this address was present in my original To: list. :) (Admittedly, not with CC.) > Reviewed-by: Paolo Bonzini Thank you! Laszlo