From eb60260de0b050a5e8ab725e84d377d0b44c43ae Mon Sep 17 00:00:00 2001 From: Yoshiaki Tamura Date: Thu, 3 Feb 2011 13:34:08 +0900 Subject: savevm: fix corruption in vmstate_subsection_load(). Although it's rare to happen in live migration, when the head of a byte stream contains 0x05 which is the marker of subsection, the loader gets corrupted because vmstate_subsection_load() continues even the device doesn't require it. This patch adds a checker whether subsection is needed, and skips following routines if not needed. Signed-off-by: Yoshiaki Tamura Acked-by: Paolo Bonzini Signed-off-by: Anthony Liguori --- savevm.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'savevm.c') diff --git a/savevm.c b/savevm.c index 4453217..6d83b0f 100644 --- a/savevm.c +++ b/savevm.c @@ -1638,6 +1638,12 @@ static const VMStateDescription *vmstate_get_subsection(const VMStateSubsection static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd, void *opaque) { + const VMStateSubsection *sub = vmsd->subsections; + + if (!sub || !sub->needed) { + return 0; + } + while (qemu_peek_byte(f) == QEMU_VM_SUBSECTION) { char idstr[256]; int ret; @@ -1650,10 +1656,11 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd, idstr[len] = 0; version_id = qemu_get_be32(f); - sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr); + sub_vmsd = vmstate_get_subsection(sub, idstr); if (sub_vmsd == NULL) { return -ENOENT; } + assert(!sub_vmsd->subsections); ret = vmstate_load_state(f, sub_vmsd, opaque, version_id); if (ret) { return ret; @@ -1677,6 +1684,7 @@ static void vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd, qemu_put_byte(f, len); qemu_put_buffer(f, (uint8_t *)vmsd->name, len); qemu_put_be32(f, vmsd->version_id); + assert(!vmsd->subsections); vmstate_save_state(f, vmsd, opaque); } sub++; -- cgit v1.1