From patchwork Tue Mar  9 13:15:45 2010
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: virtio-serial NULL deference
Date: Tue, 09 Mar 2010 03:15:45 -0000
From: Juan Quintela <quintela@redhat.com>
X-Patchwork-Id: 47159
Message-Id: <m3k4tl4ovy.fsf@trasno.mitica>
To: qemu-devel <qemu-devel@nongnu.org>, amit.shah@redhat.com
Cc: 

Hi Amit

Checking migration, I just found this problem:

I don't know what to put there.  a return -EINVAL or continue?
Looking more at the code, I am not sure what checks:

a- that bus->max_nr_ports is the same in both sides (or at least bigger
   on migration destination)
b- We sent the value of config.nr_ports, but ... we assign it back on
   destination, instead of checking that they are the same.
c- port->id is taken from nr_ports again, and nothing checks that ports
   appear in the same order in source and destination.

Throughts?

Later, Juan.

diff --cc configure
index cab1941,83f8b26..0000000
--- a/configure
+++ b/configure
diff --git a/hw/virtio-serial-bus.c b/hw/virtio-serial-bus.c
index d0e0219..7d2f0b9 100644


--- a/hw/virtio-serial-bus.c
+++ b/hw/virtio-serial-bus.c
@@ -429,6 +429,10 @@ static int virtio_serial_load(QEMUFile *f, void *opaque, int version_id)
         id = qemu_get_be32(f);
         port = find_port_by_id(s, id);

+        if (port == NULL) {
+            return -EINVAL;
+        }
+
         port->guest_connected = qemu_get_byte(f);
     }