[Xen-changelog] [qemu-xen master] ipmi: fix qemu crash while migrating with ipmi

[patchbot@xxxxxxx]

commit d668fc4c7c69a3251be5965601015f3c17800818
Author:     ZhuangYanying <ann.zhuangyanying@xxxxxxxxxx>
AuthorDate: Fri Nov 18 16:22:48 2016 +0800
Commit:     Michael S. Tsirkin <mst@xxxxxxxxxx>
CommitDate: Fri Nov 18 17:50:09 2016 +0200

    ipmi: fix qemu crash while migrating with ipmi
    
    Qemu crash in the source side while migrating, after starting ipmi service 
inside vm.
    
    ./x86_64-softmmu/qemu-system-x86_64 --enable-kvm -smp 4 -m 4096 \
    -drive 
file=/work/suse/suse11_sp3_64_vt,format=raw,if=none,id=drive-virtio-disk0,cache=none
 \
    -device 
virtio-blk-pci,scsi=off,bus=pci.0,addr=0x5,drive=drive-virtio-disk0,id=virtio-disk0
 \
    -vnc :99 -monitor vc -device ipmi-bmc-sim,id=bmc0 -device 
isa-ipmi-kcs,bmc=bmc0,ioport=0xca2
    
    Program received signal SIGSEGV, Segmentation fault.
    [Switching to Thread 0x7ffec4268700 (LWP 7657)]
    __memcpy_ssse3_back () at 
../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2757
    (gdb) bt
     #0  __memcpy_ssse3_back () at 
../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2757
     #1  0x00005555559ef775 in memcpy (__len=3, __src=0xc1421c, 
__dest=<optimized out>)
         at /usr/include/bits/string3.h:51
     #2  qemu_put_buffer (f=0x555557a97690, buf=0xc1421c <Address 0xc1421c out 
of bounds>, size=3)
         at migration/qemu-file.c:346
     #3  0x00005555559eef66 in vmstate_save_state (f=f@entry=0x555557a97690,
         vmsd=0x555555f8a5a0 <vmstate_ISAIPMIKCSDevice>, opaque=0x555557231160,
         vmdesc=vmdesc@entry=0x55555798cc40) at migration/vmstate.c:333
     #4  0x00005555557cfe45 in vmstate_save (f=f@entry=0x555557a97690, 
se=se@entry=0x555557231de0,
         vmdesc=vmdesc@entry=0x55555798cc40) at 
/mnt/sdb/zyy/qemu/migration/savevm.c:720
     #5  0x00005555557d2be7 in qemu_savevm_state_complete_precopy 
(f=0x555557a97690,
         iterable_only=iterable_only@entry=false) at 
/mnt/sdb/zyy/qemu/migration/savevm.c:1128
     #6  0x00005555559ea102 in migration_completion (start_time=<synthetic 
pointer>,
         old_vm_running=<synthetic pointer>, current_active_state=<optimized 
out>,
         s=0x5555560eaa80 <current_migration.44078>) at 
migration/migration.c:1707
     #7  migration_thread (opaque=0x5555560eaa80 <current_migration.44078>) at 
migration/migration.c:1855
     #8  0x00007ffff3900dc5 in start_thread (arg=0x7ffec4268700) at 
pthread_create.c:308
     #9  0x00007fffefc6c71d in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:113
    
    Signed-off-by: Zhuang Yanying <ann.zhuangyanying@xxxxxxxxxx>
    Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Signed-off-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
---
 hw/ipmi/isa_ipmi_kcs.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/ipmi/isa_ipmi_kcs.c b/hw/ipmi/isa_ipmi_kcs.c
index 9a38f8a..8044497 100644
--- a/hw/ipmi/isa_ipmi_kcs.c
+++ b/hw/ipmi/isa_ipmi_kcs.c
@@ -433,10 +433,8 @@ const VMStateDescription vmstate_ISAIPMIKCSDevice = {
         VMSTATE_BOOL(kcs.use_irq, ISAIPMIKCSDevice),
         VMSTATE_BOOL(kcs.irqs_enabled, ISAIPMIKCSDevice),
         VMSTATE_UINT32(kcs.outpos, ISAIPMIKCSDevice),
-        VMSTATE_VBUFFER_UINT32(kcs.outmsg, ISAIPMIKCSDevice, 1, NULL, 0,
-                               kcs.outlen),
-        VMSTATE_VBUFFER_UINT32(kcs.inmsg, ISAIPMIKCSDevice, 1, NULL, 0,
-                               kcs.inlen),
+        VMSTATE_UINT8_ARRAY(kcs.outmsg, ISAIPMIKCSDevice, MAX_IPMI_MSG_SIZE),
+        VMSTATE_UINT8_ARRAY(kcs.inmsg, ISAIPMIKCSDevice, MAX_IPMI_MSG_SIZE),
         VMSTATE_BOOL(kcs.write_end, ISAIPMIKCSDevice),
         VMSTATE_UINT8(kcs.status_reg, ISAIPMIKCSDevice),
         VMSTATE_UINT8(kcs.data_out_reg, ISAIPMIKCSDevice),
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#master

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog