Re: [Qemu-devel] [PATCH 0.14] savevm: fix corruption in vmstate_subsection_load().

[Anthony Liguori]

On 02/02/2011 10:34 PM, Yoshiaki Tamura wrote:
> Although it's rare to happen in live migration, when the head of a
> byte stream contains 0x05 which is the marker of subsection, the
> loader gets corrupted because vmstate_subsection_load() continues even
> the device doesn't require it.  This patch adds a checker whether
> subsection is needed, and skips following routines if not needed.
>
> Signed-off-by: Yoshiaki Tamura<address@hidden>
> Acked-by: Paolo Bonzini<address@hidden>
>    

Applied to master, Thanks.

Regards,

Anthony Liguori

> ---
>   savevm.c |   10 +++++++++-
>   1 files changed, 9 insertions(+), 1 deletions(-)
>
> diff --git a/savevm.c b/savevm.c
> index 4453217..6d83b0f 100644
> --- a/savevm.c
> +++ b/savevm.c
> @@ -1638,6 +1638,12 @@ static const VMStateDescription 
> *vmstate_get_subsection(const VMStateSubsection
>   static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription 
> *vmsd,
>                                      void *opaque)
>   {
> +    const VMStateSubsection *sub = vmsd->subsections;
> +
> +    if (!sub || !sub->needed) {
> +        return 0;
> +    }
> +
>       while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) {
>           char idstr[256];
>           int ret;
> @@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const 
> VMStateDescription *vmsd,
>           idstr[len] = 0;
>           version_id = qemu_get_be32(f);
>
> -        sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);
> +        sub_vmsd = vmstate_get_subsection(sub, idstr);
>           if (sub_vmsd == NULL) {
>               return -ENOENT;
>           }
> +        assert(!sub_vmsd->subsections);
>           ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
>           if (ret) {
>               return ret;
> @@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const 
> VMStateDescription *vmsd,
>               qemu_put_byte(f, len);
>               qemu_put_buffer(f, (uint8_t *)vmsd->name, len);
>               qemu_put_be32(f, vmsd->version_id);
> +            assert(!vmsd->subsections);
>               vmstate_save_state(f, vmsd, opaque);
>           }
>           sub++;
>