diff options
| author | Yunjian Wang <wangyunjian@huawei.com> | 2017-04-26 14:45:56 +0800 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2017-08-03 14:52:02 -0500 |
| commit | 0b185544c98671373a7ea9f2abc1de50a498a722 (patch) | |
| tree | 74c483ba77f75a46a96f841dff8b6c6746ff68e5 /hw | |
| parent | f3676379cc9f2c803e5e35e1fb7e0ae2041f6f1a (diff) | |
| download | qemu-0b185544c98671373a7ea9f2abc1de50a498a722.tar.gz | |
virtio-net: fix wild pointer when remove virtio-net queues
The tx_bh or tx_timer will free in virtio_net_del_queue() function, when
removing virtio-net queues if the guest doesn't support multiqueue. But
it might be still referenced by virtio_net_set_status(), which needs to
be set NULL. And also the tx_waiting needs to be set zero to prevent
virtio_net_set_status() accessing tx_bh or tx_timer.
Cc: qemu-stable@nongnu.org
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
(cherry picked from commit f989c30cf834ba8625e98b808eac30e4e7ec5008)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/net/virtio-net.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 7d091c9259..98bd683f31 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1522,9 +1522,12 @@ static void virtio_net_del_queue(VirtIONet *n, int index) if (q->tx_timer) { timer_del(q->tx_timer); timer_free(q->tx_timer); + q->tx_timer = NULL; } else { qemu_bh_delete(q->tx_bh); + q->tx_bh = NULL; } + q->tx_waiting = 0; virtio_del_queue(vdev, index * 2 + 1); } |