From patchwork Tue Jun 10 08:04:23 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Lieven X-Patchwork-Id: 357769 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id B43D11400AB for ; Tue, 10 Jun 2014 18:06:08 +1000 (EST) Received: from localhost ([::1]:37374 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WuH4I-00030p-At for incoming@patchwork.ozlabs.org; Tue, 10 Jun 2014 04:06:06 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50233) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WuH3b-0002NF-T5 for qemu-devel@nongnu.org; Tue, 10 Jun 2014 04:05:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WuH3X-0007Ru-16 for qemu-devel@nongnu.org; Tue, 10 Jun 2014 04:05:23 -0400 Received: from mx-v6.kamp.de ([2a02:248:0:51::16]:45764 helo=mx01.kamp.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WuH3W-0007Rj-Nu for qemu-devel@nongnu.org; Tue, 10 Jun 2014 04:05:18 -0400 Received: (qmail 3310 invoked by uid 89); 10 Jun 2014 08:05:18 -0000 Received: from [82.141.1.145] by client-16-kamp (envelope-from , uid 89) with qmail-scanner-2010/03/19-MF (clamdscan: 0.98.3/19080. hbedv: 8.3.20.8/7.11.154.26. spamassassin: 3.4.0. Clear:RC:1(82.141.1.145):SA:0(-1.2/4.0):. Processed in 1.199769 secs); 10 Jun 2014 08:05:18 -0000 Received: from ns.kamp-intra.net (HELO dns.kamp-intra.net) ([82.141.1.145]) by mx01.kamp.de with SMTP; 10 Jun 2014 08:05:16 -0000 X-GL_Whitelist: yes Received: from lieven-pc.kamp-intra.net (lieven-pc.kamp-intra.net [172.21.12.60]) by dns.kamp-intra.net (Postfix) with ESMTP id A6E0920695; Tue, 10 Jun 2014 10:04:26 +0200 (CEST) Received: by lieven-pc.kamp-intra.net (Postfix, from userid 1000) id 9CE865FC70; Tue, 10 Jun 2014 10:04:26 +0200 (CEST) From: Peter Lieven To: qemu-devel@nongnu.org, --cc=dgilbert@redhat.com Date: Tue, 10 Jun 2014 10:04:23 +0200 Message-Id: <1402387463-17246-1-git-send-email-pl@kamp.de> X-Mailer: git-send-email 1.7.9.5 X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2a02:248:0:51::16 Cc: quintela@redhat.com, Peter Lieven , qemu-stable@nongnu.org, amit.shah@redhat.com, pbonzini@redhat.com Subject: [Qemu-devel] [PATCHv3] migration: catch unknown flags in ram_load X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org if a saved vm has unknown flags in the memory data qemu currently simply ignores this flag and continues which yields in an unpredictable result. this patch catches all unknown flags and aborts the loading of the vm. CC: qemu-stable@nongnu.org Signed-off-by: Peter Lieven Reviewed-by: Amit Shah --- v2->v3: - reworked last case in the if statement - added an error_report in case of an unknown flag [David] v1->v2: rework loop from do ... while to while [Juan] arch_init.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/arch_init.c b/arch_init.c index 9f1a174..93a1191 100644 --- a/arch_init.c +++ b/arch_init.c @@ -1041,17 +1041,15 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) { ram_addr_t addr; int flags, ret = 0; - int error; static uint64_t seq_iter; seq_iter++; if (version_id != 4) { ret = -EINVAL; - goto done; } - do { + while (!ret) { addr = qemu_get_be64(f); flags = addr & ~TARGET_PAGE_MASK; @@ -1079,7 +1077,6 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) " in != " RAM_ADDR_FMT, id, length, block->length); ret = -EINVAL; - goto done; } break; } @@ -1089,21 +1086,21 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) error_report("Unknown ramblock \"%s\", cannot " "accept migration", id); ret = -EINVAL; - goto done; + } + if (ret) { + break; } total_ram_bytes -= length; } - } - - if (flags & RAM_SAVE_FLAG_COMPRESS) { + } else if (flags & RAM_SAVE_FLAG_COMPRESS) { void *host; uint8_t ch; host = host_from_stream_offset(f, addr, flags); if (!host) { ret = -EINVAL; - goto done; + break; } ch = qemu_get_byte(f); @@ -1114,7 +1111,7 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) host = host_from_stream_offset(f, addr, flags); if (!host) { ret = -EINVAL; - goto done; + break; } qemu_get_buffer(f, host, TARGET_PAGE_SIZE); @@ -1122,24 +1119,23 @@ static int ram_load(QEMUFile *f, void *opaque, int version_id) void *host = host_from_stream_offset(f, addr, flags); if (!host) { ret = -EINVAL; - goto done; + break; } if (load_xbzrle(f, addr, host) < 0) { ret = -EINVAL; - goto done; + break; } } else if (flags & RAM_SAVE_FLAG_HOOK) { ram_control_load_hook(f, flags); + } else if (!(flags & RAM_SAVE_FLAG_EOS)) { + error_report("Unknown migration flags: %#x", flags); + ret = -EINVAL; + break; } - error = qemu_file_get_error(f); - if (error) { - ret = error; - goto done; - } - } while (!(flags & RAM_SAVE_FLAG_EOS)); + ret = qemu_file_get_error(f); + } -done: DPRINTF("Completed load of VM with exit code %d seq iteration " "%" PRIu64 "\n", ret, seq_iter); return ret;