From nobody Mon Feb 9 05:29:26 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1663581426; cv=none; d=zohomail.com; s=zohoarc; b=ZcyMhYnDAi8QiDXGRUCrIu94gOBbUmxh1wKxMY+yEhwLikh/iZc9IBeJ/7e/zd9QcISwTKNuyugYoBFwlcR+hxJRdBHvJiRMzE4AcQHy0QPC0jNSkgr2L03DK2uQKqTBXXEInK3/bCwC9jO9mM5obXd8g4qcxreTCp8vwCKoBjw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1663581426; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=8CZXVK+zLhv2F/Xuq1Sg7q8DhSE4K8Q7VfwutZ43vCY=; b=bpkFqYPFgX7CvCxfVJzGCBs0kHu917LMGpl6zlp5kIe2XfmVZKI7UC1YMYPEyyUL4g7pIlMLWLdqMtxtioho0rJfSIhOCfFZl1I5hB5R0Dia8nPIIGxG1PqNrASyQz1QximvIAdpKgf9FvhQxXgpbC2wbIcjiJ2zB2sN7XlHmUc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1663581426167842.7589285369752; Mon, 19 Sep 2022 02:57:06 -0700 (PDT) Received: from localhost ([::1]:41378 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oaDWT-0004Yt-4R for importer@patchew.org; Mon, 19 Sep 2022 05:57:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54558) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oaDHA-0003cj-6q for qemu-devel@nongnu.org; Mon, 19 Sep 2022 05:41:16 -0400 Received: from mga14.intel.com ([192.55.52.115]:34588) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oaDH7-0006ST-5k for qemu-devel@nongnu.org; Mon, 19 Sep 2022 05:41:15 -0400 Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Sep 2022 02:41:09 -0700 Received: from duan-server-s2600bt.bj.intel.com ([10.240.192.143]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Sep 2022 02:41:08 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1663580473; x=1695116473; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=v9z23O3MmbIAjZcPfd+/R/pBmVPmjCX1J44nBACW9cE=; b=PwQs4OmwvaxxG/56e8DuDueo5khAQjereDdcIf/LyPK2hmfjriiBqJYJ sugZdkycjk2peHSwAB4yMpja8mavbbUqTbGik45gKU356P5/zDp/X3QTE MM3wG3KAwHHiCDoRdAJcePQu1TGy4fuDt6slzQrzlRvxA1CU2OsuG050G IGI+fMI6pyyMIGyRj8ksNeQiKvOjZZZZ/RRFOCwEnvYLGPPy8coloOqXh bKto6CbOmbtYRQBIkGiG8VY54X4D/5UcP2V4hQ8DETfcPFX+ruRs1GRHv aohQI9XO1UD4UzUX8jn1Vt/AIXIygdabP7kqahpsViKXNIKcuvREU4jXb A==; X-IronPort-AV: E=McAfee;i="6500,9779,10474"; a="299345701" X-IronPort-AV: E=Sophos;i="5.93,327,1654585200"; d="scan'208";a="299345701" X-IronPort-AV: E=Sophos;i="5.93,327,1654585200"; d="scan'208";a="680780299" From: Zhenzhong Duan To: qemu-devel@nongnu.org Cc: quintela@redhat.com, dgilbert@redhat.com Subject: [PATCH] migration: Fix a potential guest memory corruption Date: Mon, 19 Sep 2022 17:32:37 +0800 Message-Id: <20220919093237.2219892-1-zhenzhong.duan@intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.55.52.115; envelope-from=zhenzhong.duan@intel.com; helo=mga14.intel.com X-Spam_score_int: -70 X-Spam_score: -7.1 X-Spam_bar: ------- X-Spam_report: (-7.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1663581427111100001 Content-Type: text/plain; charset="utf-8" Imagine a rare case, after a dirty page is sent to compression threads's ring, dirty bitmap sync trigger right away and mark the same page dirty again and sent. Then the new page may be overwriten by stale page in compression threads's ring in the destination. So we need to ensure there is only one copy of the same dirty page either by flushing the ring after every bitmap sync or avoiding processing same dirty page continuously. I choose the 2nd which avoids the time consuming flush operation. Signed-off-by: Zhenzhong Duan --- migration/ram.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/migration/ram.c b/migration/ram.c index dc1de9ddbc68..67b2035586bd 100644 --- a/migration/ram.c +++ b/migration/ram.c @@ -1551,7 +1551,7 @@ static bool find_dirty_block(RAMState *rs, PageSearch= Status *pss, bool *again) pss->postcopy_requested =3D false; pss->postcopy_target_channel =3D RAM_CHANNEL_PRECOPY; =20 - pss->page =3D migration_bitmap_find_dirty(rs, pss->block, pss->page); + pss->page =3D migration_bitmap_find_dirty(rs, pss->block, pss->page + = 1); if (pss->complete_round && pss->block =3D=3D rs->last_seen_block && pss->page >=3D rs->last_page) { /* @@ -1564,7 +1564,7 @@ static bool find_dirty_block(RAMState *rs, PageSearch= Status *pss, bool *again) if (!offset_in_ramblock(pss->block, ((ram_addr_t)pss->page) << TARGET_PAGE_BITS)) { /* Didn't find anything in this RAM Block */ - pss->page =3D 0; + pss->page =3D -1; pss->block =3D QLIST_NEXT_RCU(pss->block, next); if (!pss->block) { /* @@ -2694,7 +2694,7 @@ static void ram_state_reset(RAMState *rs) { rs->last_seen_block =3D NULL; rs->last_sent_block =3D NULL; - rs->last_page =3D 0; + rs->last_page =3D -1; rs->last_version =3D ram_list.version; rs->xbzrle_enabled =3D false; postcopy_preempt_reset(rs); @@ -2889,7 +2889,7 @@ void ram_postcopy_send_discard_bitmap(MigrationState = *ms) /* Easiest way to make sure we don't resume in the middle of a host-pa= ge */ rs->last_seen_block =3D NULL; rs->last_sent_block =3D NULL; - rs->last_page =3D 0; + rs->last_page =3D -1; =20 postcopy_each_ram_send_discard(ms); =20 --=20 2.25.1