[Qemu-commits] [qemu/qemu] 4fcefd: migration: fix potential overflow in multifd send

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 4fcefd44a074008e490ff54c3c28a08b8dbfb14b
      
https://github.com/qemu/qemu/commit/4fcefd44a074008e490ff54c3c28a08b8dbfb14b
  Author: Peter Xu <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M migration/ram.c

  Log Message:
  -----------
  migration: fix potential overflow in multifd send

I would guess it won't happen normally, but this should ease Coverity.

>>>     CID 1394385:  Integer handling issues  (OVERFLOW_BEFORE_WIDEN)
>>>     Potentially overflowing expression "pages->used * 8192U" with type 
>>> "unsigned int" (32 bits, unsigned) is evaluated using 32-bit arithmetic, 
>>> and then used in a context that expects an expression of type "uint64_t" 
>>> (64 bits, unsigned).
854         transferred = pages->used * TARGET_PAGE_SIZE + p->packet_len;

Fixes: CID 1394385
CC: Juan Quintela <address@hidden>
Signed-off-by: Peter Xu <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 57225e5f32bb051c9eb03758647963aeb72cebbf
      
https://github.com/qemu/qemu/commit/57225e5f32bb051c9eb03758647963aeb72cebbf
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migrate: Fix cancelling state warning

We've been getting the warning:

migration_iteration_finish: Unknown ending state 2

on a cancel.

I think that's originally due to 39b9e17905c;  although
I've only seen the warning, I think that in some cases
that we could find the VM stays paused after a cancel where
it should restart.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Peter Xu <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 67fa1f5700248fc66d5b1526c268737e29892b86
      
https://github.com/qemu/qemu/commit/67fa1f5700248fc66d5b1526c268737e29892b86
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M hw/audio/hda-codec.c

  Log Message:
  -----------
  audio/hda: Fix migration

Fix outgoing migration which was crashing in
vmstate_hda_audio_stream_buf_needed, I think the problem
is that we have room for upto 4 streams in the array but only
use 2, when we come to try and save the state of the unused
streams we hit st->state == NULL.

Fixes: 280c1e1cdb24d80ecdfc
Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Daniel P. Berrangé <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 814bb08f177af8dc67e155f0ad622fb6366c3b85
      
https://github.com/qemu/qemu/commit/814bb08f177af8dc67e155f0ad622fb6366c3b85
  Author: Peter Xu <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M migration/ram.c

  Log Message:
  -----------
  migration: update recv bitmap only on dest vm

We shouldn't update the received bitmap if we're the source VM.  This
fixes a breakage when release-ram is enabled on postcopy.

Signed-off-by: Peter Xu <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 97ca211c6216ccfcb64c46f739a0ce36042d9ea8
      
https://github.com/qemu/qemu/commit/97ca211c6216ccfcb64c46f739a0ce36042d9ea8
  Author: Peter Xu <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: disallow recovery for release-ram

Postcopy recovery won't work well with release-ram capability since
release-ram will drop the page buffer as long as the page is put into
the send buffer.  So if there is a network failure happened, any page
buffers that have not yet reached the destination VM but have already
been sent from the source VM will be lost forever.  Let's refuse the
client from resuming such a postcopy migration.  Luckily release-ram was
designed to only be used when src and destination VMs are on the same
host, so it should be fine.

Signed-off-by: Peter Xu <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 829db8b497d855d39f85df4de9472c0b74ec5c3f
      
https://github.com/qemu/qemu/commit/829db8b497d855d39f85df4de9472c0b74ec5c3f
  Author: Peter Xu <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M tests/migration-test.c

  Log Message:
  -----------
  tests: only update last_byte when at the edge

The only possible change of last_byte is when it reaches the edge.
Setting it every time might let last_byte contain an invalid data when
memory corruption is detected, then the check of the next byte will be
incorrect.  For example, a single page corruption at address 0x14ad000
will also lead to a "fake" corruption at 0x14ae000:

  Memory content inconsistency at 14ad000 first_byte = 44 last_byte = 44 
current = ef hit_edge = 0
  Memory content inconsistency at 14ae000 first_byte = 44 last_byte = ef 
current = 44 hit_edge = 0

After the patch, it'll only report the corrputed page:

  Memory content inconsistency at 14ad000 first_byte = 44 last_byte = 44 
current = ef hit_edge = 0

Signed-off-by: Peter Xu <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 4b3fb65db973b51346e3456987ba80b15c1fc75c
      
https://github.com/qemu/qemu/commit/4b3fb65db973b51346e3456987ba80b15c1fc75c
  Author: Lidong Chen <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: fix duplicate initialization for expected_downtime and cleanup_bh

migrate_fd_connect duplicate initialize expected_downtime and cleanup_bh.

Signed-off-by: Lidong Chen <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Dr. David Alan Gilbert <address@hidden>


  Commit: 8ca2838de2d0c5e5166549e5d15448433efaf348
      
https://github.com/qemu/qemu/commit/8ca2838de2d0c5e5166549e5d15448433efaf348
  Author: Peter Maydell <address@hidden>
  Date:   2018-07-24 (Tue, 24 Jul 2018)

  Changed paths:
    M hw/audio/hda-codec.c
    M migration/migration.c
    M migration/ram.c
    M tests/migration-test.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20180724a' 
into staging

Migration pull for 3.0

Fixes only

# gpg: Signature made Tue 24 Jul 2018 19:31:39 BST
# gpg:                using RSA key 0516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <address@hidden>"
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20180724a:
  migration: fix duplicate initialization for expected_downtime and cleanup_bh
  tests: only update last_byte when at the edge
  migration: disallow recovery for release-ram
  migration: update recv bitmap only on dest vm
  audio/hda: Fix migration
  migrate: Fix cancelling state warning
  migration: fix potential overflow in multifd send

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/debe96fdeca9...8ca2838de2d0
      **NOTE:** This service been marked for deprecation: 
https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.