On 07/22/14 17:42, Paolo Bonzini wrote:
> Il 22/07/2014 17:26, Laszlo Ersek ha scritto:
>> "vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live
>> migration support"), and first released in v1.6.0. The field list in this
>> VMSD is not terminated with the VMSTATE_END_OF_LIST() macro.
>>
>> During normal use (ie. migration), the issue is practically invisible,
>> because the "vmstate_xhci_event" object (with the unterminated field list)
>> is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full()
>> returns true, for the "ev_buffer" test. Since that field_exists() check
>> (apparently) almost always returns false, we almost never traverse
>> "vmstate_xhci_event" during migration, which hides the bug.
>>
>> However, Amit's vmstate checker forces recursion into this VMSD as well,
>> and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator
>> check (field->name != NULL) in dump_vmstate_vmsd(). The result is
>> undefined behavior, which in my case translates to infinite recursion
>> (because the loop happens to overflow into "vmstate_xhci_intr", which then
>> links back to "vmstate_xhci_event").
>>
>> Add the missing terminator.
>>
>> Signed-off-by: Laszlo Ersek <ler...@redhat.com>
>> ---
>> hw/usb/hcd-xhci.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
>> index 7f2af89..58c4b11 100644
>> --- a/hw/usb/hcd-xhci.c
>> +++ b/hw/usb/hcd-xhci.c
>> @@ -3737,6 +3737,7 @@ static const VMStateDescription vmstate_xhci_event = {
>> VMSTATE_UINT32(flags, XHCIEvent),
>> VMSTATE_UINT8(slotid, XHCIEvent),
>> VMSTATE_UINT8(epid, XHCIEvent),
>> + VMSTATE_END_OF_LIST()
>> }
>> };
>>
>>
>
> Cc: qemu-sta...@nongnu.org
As far as I can see, this address was present in my original To: list.
:) (Admittedly, not with CC.)
> Reviewed-by: Paolo Bonzini <pbonz...@redhat.com>
Thank you!
Laszlo
