[PATCH] fix segfault in xl migrate --debug

[PATCH] fix segfault in xl migrate --debug

[M A Young]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 274 bytes --]

If differences are found during the verification phase of xl migrate 
--debug then it is likely to crash with a segfault because the bogus
pagebuf->pfn_types[pfn] is used in a print statement instead of 
pfn_type[pfn] .

Signed-off-by: Michael Young <m.a.young@durham.ac.uk>

[-- Attachment #2: Type: TEXT/PLAIN, Size: 680 bytes --]

xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is
used in a print statement instead of pfn_type[pfn] 

--- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig	2014-10-24 15:22:40.000000000 +0100
+++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c	2014-11-25 21:01:16.604081467 +0000
@@ -1404,7 +1404,7 @@
                 int v;
 
                 DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx "
-                        "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn],
+                        "actualcs=%08lx\n", pfn, pfn_type[pfn],
                         csum_page(region_base + i * PAGE_SIZE),
                         csum_page(buf));
 

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH] fix segfault in xl migrate --debug

[Andrew Cooper]

[-- Attachment #1.1: Type: text/plain, Size: 1077 bytes --]

On 26/11/2014 19:54, M A Young wrote:
> If differences are found during the verification phase of xl migrate
> --debug then it is likely to crash with a segfault because the bogus
> pagebuf->pfn_types[pfn] is used in a print statement instead of
> pfn_type[pfn] .
>
> Signed-off-by: Michael Young <m.a.young@durham.ac.uk>
>
>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

> xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is
> used in a print statement instead of pfn_type[pfn] 
>
> --- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig	2014-10-24 15:22:40.000000000 +0100
> +++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c	2014-11-25 21:01:16.604081467 +0000
> @@ -1404,7 +1404,7 @@
>                  int v;
>  
>                  DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx "
> -                        "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn],
> +                        "actualcs=%08lx\n", pfn, pfn_type[pfn],
>                          csum_page(region_base + i * PAGE_SIZE),
>                          csum_page(buf));
>  


[-- Attachment #1.2: Type: text/html, Size: 2157 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: [PATCH] fix segfault in xl migrate --debug

[Ian Campbell]

On Wed, 2014-11-26 at 21:19 +0000, Andrew Cooper wrote:
> On 26/11/2014 19:54, M A Young wrote:
> 
> > If differences are found during the verification phase of xl migrate
> > --debug then it is likely to crash with a segfault because the
> > bogus 
> > pagebuf->pfn_types[pfn] is used in a print statement instead of
> > pfn_type[pfn] . 
> > 
> > Signed-off-by: Michael Young <m.a.young@durham.ac.uk>
> > 
> > 
> > 
> 
> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>

Needs a release ack if this is to be for 4.5, Konrad CCd.

On the one hand this fixes an issue which is only present if you enable
debug/verify mode, so it's not that critical. On the other hand it only
touches code which is used if you enable debug/verify mode, so it's not
that risky.

I'm inclined towards the apply it for 4.5 end of the scale...

> 
> > xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is
> > used in a print statement instead of pfn_type[pfn] 
> > 
> > --- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig	2014-10-24 15:22:40.000000000 +0100
> > +++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c	2014-11-25 21:01:16.604081467 +0000
> > @@ -1404,7 +1404,7 @@
> >                  int v;
> >  
> >                  DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx "
> > -                        "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn],
> > +                        "actualcs=%08lx\n", pfn, pfn_type[pfn],
> >                          csum_page(region_base + i * PAGE_SIZE),
> >                          csum_page(buf));
> >  
> 

Re: [PATCH] fix segfault in xl migrate --debug

[Konrad Rzeszutek Wilk]

On Fri, Nov 28, 2014 at 12:09:41PM +0000, Ian Campbell wrote:
> On Wed, 2014-11-26 at 21:19 +0000, Andrew Cooper wrote:
> > On 26/11/2014 19:54, M A Young wrote:
> > 
> > > If differences are found during the verification phase of xl migrate
> > > --debug then it is likely to crash with a segfault because the
> > > bogus 
> > > pagebuf->pfn_types[pfn] is used in a print statement instead of
> > > pfn_type[pfn] . 
> > > 
> > > Signed-off-by: Michael Young <m.a.young@durham.ac.uk>
> > > 
> > > 
> > > 
> > 
> > Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
> 
> Acked-by: Ian Campbell <ian.campbell@citrix.com>
> 
> Needs a release ack if this is to be for 4.5, Konrad CCd.
> 
> On the one hand this fixes an issue which is only present if you enable
> debug/verify mode, so it's not that critical. On the other hand it only
> touches code which is used if you enable debug/verify mode, so it's not
> that risky.
> 
> I'm inclined towards the apply it for 4.5 end of the scale...

Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> 
> > 
> > > xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is
> > > used in a print statement instead of pfn_type[pfn] 
> > > 
> > > --- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig	2014-10-24 15:22:40.000000000 +0100
> > > +++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c	2014-11-25 21:01:16.604081467 +0000
> > > @@ -1404,7 +1404,7 @@
> > >                  int v;
> > >  
> > >                  DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx "
> > > -                        "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn],
> > > +                        "actualcs=%08lx\n", pfn, pfn_type[pfn],
> > >                          csum_page(region_base + i * PAGE_SIZE),
> > >                          csum_page(buf));
> > >  
> > 
> 
> 

Re: [PATCH] fix segfault in xl migrate --debug

[M A Young]

On Mon, 1 Dec 2014, Konrad Rzeszutek Wilk wrote:

> On Fri, Nov 28, 2014 at 12:09:41PM +0000, Ian Campbell wrote:
>> On Wed, 2014-11-26 at 21:19 +0000, Andrew Cooper wrote:
>>> On 26/11/2014 19:54, M A Young wrote:
>>>
>>>> If differences are found during the verification phase of xl migrate
>>>> --debug then it is likely to crash with a segfault because the
>>>> bogus
>>>> pagebuf->pfn_types[pfn] is used in a print statement instead of
>>>> pfn_type[pfn] .
>>>>
>>>> Signed-off-by: Michael Young <m.a.young@durham.ac.uk>
>>>>
>>>>
>>>>
>>>
>>> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
>>
>> Acked-by: Ian Campbell <ian.campbell@citrix.com>
>>
>> Needs a release ack if this is to be for 4.5, Konrad CCd.
>>
>> On the one hand this fixes an issue which is only present if you enable
>> debug/verify mode, so it's not that critical. On the other hand it only
>> touches code which is used if you enable debug/verify mode, so it's not
>> that risky.
>>
>> I'm inclined towards the apply it for 4.5 end of the scale...
>
> Release-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
>>
>>>
>>>> xl migrate --debug can segfault because pagebuf->pfn_types[pfn] is
>>>> used in a print statement instead of pfn_type[pfn]
>>>>
>>>> --- xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c.orig	2014-10-24 15:22:40.000000000 +0100
>>>> +++ xen-4.5.0-rc1/tools/libxc/xc_domain_restore.c	2014-11-25 21:01:16.604081467 +0000
>>>> @@ -1404,7 +1404,7 @@
>>>>                  int v;
>>>>
>>>>                  DPRINTF("************** pfn=%lx type=%lx gotcs=%08lx "
>>>> -                        "actualcs=%08lx\n", pfn, pagebuf->pfn_types[pfn],
>>>> +                        "actualcs=%08lx\n", pfn, pfn_type[pfn],
>>>>                          csum_page(region_base + i * PAGE_SIZE),
>>>>                          csum_page(buf));
>>>>

Is this patch going to get committed in time for xen 4.5?

 	Michael Young

Re: [PATCH] fix segfault in xl migrate --debug

[Wei Liu]

On Tue, Dec 16, 2014 at 08:38:42PM +0000, M A Young wrote:
[...]
> Is this patch going to get committed in time for xen 4.5?
> 

Yes. See d36a3734a6.

And there's a subsequence patch to fix a regression caused by that
patch. See 09b7ff1a.

Wei.

> 	Michael Young

Re: [PATCH] fix segfault in xl migrate --debug

[M A Young]

On Tue, 16 Dec 2014, Wei Liu wrote:

> On Tue, Dec 16, 2014 at 08:38:42PM +0000, M A Young wrote:
> [...]
>> Is this patch going to get committed in time for xen 4.5?
>>
>
> Yes. See d36a3734a6.
>
> And there's a subsequence patch to fix a regression caused by that
> patch. See 09b7ff1a.
>
> Wei.

No that is the other bug in xl migrate --debug (it fails rather than 
segfaults).

 	Michael Young

Re: [PATCH] fix segfault in xl migrate --debug

[Wei Liu]

On Tue, Dec 16, 2014 at 10:04:25PM +0000, M A Young wrote:
> On Tue, 16 Dec 2014, Wei Liu wrote:
> 
> >On Tue, Dec 16, 2014 at 08:38:42PM +0000, M A Young wrote:
> >[...]
> >>Is this patch going to get committed in time for xen 4.5?
> >>
> >
> >Yes. See d36a3734a6.
> >
> >And there's a subsequence patch to fix a regression caused by that
> >patch. See 09b7ff1a.
> >
> >Wei.
> 
> No that is the other bug in xl migrate --debug (it fails rather than
> segfaults).
> 

Ah, I misread. Sorry.

> 	Michael Young

Re: [PATCH] fix segfault in xl migrate --debug

[Ian Campbell]

On Tue, 2014-12-16 at 22:55 +0000, Wei Liu wrote:
> On Tue, Dec 16, 2014 at 10:04:25PM +0000, M A Young wrote:
> > On Tue, 16 Dec 2014, Wei Liu wrote:
> > 
> > >On Tue, Dec 16, 2014 at 08:38:42PM +0000, M A Young wrote:
> > >[...]
> > >>Is this patch going to get committed in time for xen 4.5?
> > >>
> > >
> > >Yes. See d36a3734a6.
> > >
> > >And there's a subsequence patch to fix a regression caused by that
> > >patch. See 09b7ff1a.
> > >
> > >Wei.
> > 
> > No that is the other bug in xl migrate --debug (it fails rather than
> > segfaults).
> > 
> 
> Ah, I misread. Sorry.

I think I'd confused the two as well. 

I've now applied the thing from
<alpine.DEB.2.00.1411261906310.18561@procyon.dur.ac.uk>.

I had to jump through several hoops, first because of the attachment
containing the patch but the body containing the S-o-b and second
because the patch used DOS line endings.

Please could you investigate the use of git format-patch and/or git
send-email for future patch submissions (see
http://wiki.xen.org/wiki/Submitting_Xen_Patches for some hints on
driving those tools).

Ian.