From: David Gibson <david@gibson.dropbear.id.au>
Date: Tue, 4 Dec 2012 00:38:38 +0000 (+1100)
Subject: Fix off-by-1 error in RAM migration code
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=7ec81e56edc2b2007ce0ae3982aa5c18af9546ab;p=qemu.git

Fix off-by-1 error in RAM migration code

The code for migrating (or savevm-ing) memory pages starts off by creating
a dirty bitmap and filling it with 1s.  Except, actually, because bit
addresses are 0-based it fills every bit except bit 0 with 1s and puts an
extra 1 beyond the end of the bitmap, potentially corrupting unrelated
memory.  Oops.  This patch fixes it.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---

diff --git a/arch_init.c b/arch_init.c
index e6effe809a..b75a4c5580 100644
--- a/arch_init.c
+++ b/arch_init.c
@@ -568,7 +568,7 @@ static int ram_save_setup(QEMUFile *f, void *opaque)
     int64_t ram_pages = last_ram_offset() >> TARGET_PAGE_BITS;
 
     migration_bitmap = bitmap_new(ram_pages);
-    bitmap_set(migration_bitmap, 1, ram_pages);
+    bitmap_set(migration_bitmap, 0, ram_pages);
     migration_dirty_pages = ram_pages;
 
     bytes_transferred = 0;