diff options
author | Michal Kazior <michal.kazior@tieto.com> | 2015-04-29 11:34:59 +0000 |
---|---|---|
committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2015-07-28 18:20:04 -0500 |
commit | cf3297868c57938028bfd2d8716f56c28a78d7e4 (patch) | |
tree | 7b9a8094b3a2f1d98aae8b3ed5f995b5f481e157 | |
parent | ad9c167fd21b488c1c8cfda77e8542a97aefc14f (diff) | |
download | qemu-cf3297868c57938028bfd2d8716f56c28a78d7e4.tar.gz |
usb: fix usb-net segfault
The dev->config pointer isn't set until guest
system initializes usb devices (via
usb_desc_set_config). However qemu networking can
go through some motions prior to that, e.g.:
#0 is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653
#1 0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315
#2 0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470
#3 0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101
#4 0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470
#5 0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172
The command to reproduce most reliably was:
qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0
This wasn't strictly a problem with tap. Other
networking endpoints (vde, user) could trigger
this problem as well.
Fixes: https://bugs.launchpad.net/qemu/+bug/1050823
Cc: qemu-stable@nongnu.org
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit 278412d0e710e2e848c6e510f8308e5b1ed4d03e)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
-rw-r--r-- | hw/usb/dev-network.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c index 18669917f5..9be3a64006 100644 --- a/hw/usb/dev-network.c +++ b/hw/usb/dev-network.c @@ -1310,6 +1310,10 @@ static int usbnet_can_receive(NetClientState *nc) { USBNetState *s = qemu_get_nic_opaque(nc); + if (!s->dev.config) { + return 0; + } + if (is_rndis(s) && s->rndis_state != RNDIS_DATA_INITIALIZED) { return 1; } |