• Michael Roth's avatar
    acpi_piix4: fix segfault migrating from 1.2 · ded67782
    Michael Roth authored
     bumped the vmstate version and
    introduced an old-style load function to handle migration from prior
    (<= 1.2) versions.
    The load function passes the top-level PIIX4PMState pointer to
    vmstate_load_state() to handle nested structs for APMState and
    pci_status, which leads to corruption of the top-level PIIX4PMState,
    since pointers to the nested structs are expected.
    A segfault can be fairly reliably triggered by migrating from 1.2 and
    issuing a reset, which will trigger a number of QOM operations which
    rely on the now corrupted ObjectClass/Object members.
    Fix this by passing in the expected pointers for vmstate_load_state().
    Cc: qemu-stable@nongnu.org
    Signed-off-by: default avatarMichael Roth <mdroth@linux.vnet.ibm.com>
    Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
acpi_piix4.c 18.4 KB