Re: [Qemu-stable] [PATCH for-2.1 for-stable] vmstate_xhci_event: fix unterminated field list

[Paolo Bonzini]

Il 22/07/2014 17:26, Laszlo Ersek ha scritto:
> "vmstate_xhci_event" was introduced in commit 37352df3 ("xhci: add live
> migration support"), and first released in v1.6.0. The field list in this
> VMSD is not terminated with the VMSTATE_END_OF_LIST() macro.
> 
> During normal use (ie. migration), the issue is practically invisible,
> because the "vmstate_xhci_event" object (with the unterminated field list)
> is only ever referenced -- via "vmstate_xhci_intr" -- if xhci_er_full()
> returns true, for the "ev_buffer" test. Since that field_exists() check
> (apparently) almost always returns false, we almost never traverse
> "vmstate_xhci_event" during migration, which hides the bug.
> 
> However, Amit's vmstate checker forces recursion into this VMSD as well,
> and the lack of VMSTATE_END_OF_LIST() breaks the field list terminator
> check (field->name != NULL) in dump_vmstate_vmsd(). The result is
> undefined behavior, which in my case translates to infinite recursion
> (because the loop happens to overflow into "vmstate_xhci_intr", which then
> links back to "vmstate_xhci_event").
> 
> Add the missing terminator.
> 
> Signed-off-by: Laszlo Ersek <address@hidden>
> ---
>  hw/usb/hcd-xhci.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
> index 7f2af89..58c4b11 100644
> --- a/hw/usb/hcd-xhci.c
> +++ b/hw/usb/hcd-xhci.c
> @@ -3737,6 +3737,7 @@ static const VMStateDescription vmstate_xhci_event = {
>          VMSTATE_UINT32(flags,  XHCIEvent),
>          VMSTATE_UINT8(slotid,  XHCIEvent),
>          VMSTATE_UINT8(epid,    XHCIEvent),
> +        VMSTATE_END_OF_LIST()
>      }
>  };
>  
> 

Cc: address@hidden
Reviewed-by: Paolo Bonzini <address@hidden>