From 248464f8be7a12f22c836a6b272518ce1ebe7339 Mon Sep 17 00:00:00 2001
From: Eduardo Habkost <ehabkost@redhat.com>
Date: Thu, 24 Sep 2009 16:56:48 -0300
Subject: [PATCH 3/3] fix segfault in setting migration speed

RH-Author: Luiz Capitulino <lcapitulino@redhat.com>
Message-id: <20090923160107.5b27f658@doriath>
Patchwork-id: 3514
O-Subject: [PATCH] fix segfault in setting migration speed
Bugzilla: 522887
RH-Acked-by: Eduardo Habkost <ehabkost@redhat.com>
RH-Acked-by: Glauber Costa <glommer@redhat.com>
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>

From: Glauber Costa <glommer@redhat.com>
Bugzilla: 522887
Upstream commit: 0bb05eaff04d30609a98c0dae80bb5dba3e4e799
Found-by: Joseph Kachuck <jkachuck@redhat.com>

    fix segfault in setting migration speed

    Hi,

    Whoever wrote this migrate_set_speed function is totally stupid.

    Any failed or completed migration keeps its state to allow probing of
    migration data, but has no associated file anymore. It is, thus,
    possible to crash qemu by calling migrate_set_speed after a migration
    is finished (or failed, or cancelled), but before another one starts.

    This patch fixes it.

    Signed-off-by: Glauber Costa <glommer@redhat.com>
    Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 qemu/savevm.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/qemu/savevm.c b/qemu/savevm.c
index 7089b7d..66aaf99 100644
--- a/qemu/savevm.c
+++ b/qemu/savevm.c
@@ -573,7 +573,9 @@ int qemu_file_rate_limit(QEMUFile *f)
 
 size_t qemu_file_set_rate_limit(QEMUFile *f, size_t new_rate)
 {
-    if (f->set_rate_limit)
+    /* any failed or completed migration keeps its state to allow probing of
+     * migration data, but has no associated file anymore */
+    if (f && f->set_rate_limit)
         return f->set_rate_limit(f->opaque, new_rate);
 
     return 0;
-- 
1.6.3.rc4.29.g8146