From 07897bd0d4a680df03421c0eab96cfa41de2d9f6 Mon Sep 17 00:00:00 2001 From: Don Slutz Date: Tue, 12 Nov 2013 08:22:53 -0500 Subject: [BUGFIX][PATCH v3 1/1] hvm_save_one: return correct data. It is possible that hvm_sr_handlers[typecode].save does not use all the provided room. Also it can use variable sized records. In both cases, using: instance * hvm_sr_handlers[typecode].size does not select the correct instance. Add code to search for the correct instance. Signed-off-by: Don Slutz --- changes v2 to v3: merge in patch #4. changes v1 to v2: fix coding style and coding issues. xen/common/hvm/save.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/xen/common/hvm/save.c b/xen/common/hvm/save.c index de76ada..a7e0edc 100644 --- a/xen/common/hvm/save.c +++ b/xen/common/hvm/save.c @@ -98,9 +98,6 @@ int hvm_save_one(struct domain *d, uint16_t typecode, uint16_t instance, else sz = hvm_sr_handlers[typecode].size; - if ( (instance + 1) * hvm_sr_handlers[typecode].size > sz ) - return -EINVAL; - ctxt.size = sz; ctxt.data = xmalloc_bytes(sz); if ( !ctxt.data ) @@ -112,13 +109,26 @@ int hvm_save_one(struct domain *d, uint16_t typecode, uint16_t instance, d->domain_id, typecode); rv = -EFAULT; } - else if ( copy_to_guest(handle, - ctxt.data - + (instance * hvm_sr_handlers[typecode].size) - + sizeof (struct hvm_save_descriptor), - hvm_sr_handlers[typecode].size - - sizeof (struct hvm_save_descriptor)) ) - rv = -EFAULT; + else + { + uint32_t off; + struct hvm_save_descriptor *desc; + + rv = -EBADSLT; + for ( off = 0; off < ctxt.cur; off += desc->length ) + { + desc = (void *)ctxt.data + off; + /* Move past header */ + off += sizeof(*desc); + if ( instance == desc->instance ) + { + rv = 0; + if ( copy_to_guest(handle, ctxt.data + off, desc->length) ) + rv = -EFAULT; + break; + } + } + } xfree(ctxt.data); return rv; -- 1.8.4