aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorYunjian Wang <wangyunjian@huawei.com>2017-04-26 14:45:56 +0800
committerJason Wang <jasowang@redhat.com>2017-05-23 10:10:38 +0800
commitf989c30cf834ba8625e98b808eac30e4e7ec5008 (patch)
treef9a8debf2839b06da475bdf72993dd13304c763b
parentf5ab20a4682959f06efe0787950a6c48a3e6f8fa (diff)
downloadqemu-arm-f989c30cf834ba8625e98b808eac30e4e7ec5008.tar.gz
virtio-net: fix wild pointer when remove virtio-net queues
The tx_bh or tx_timer will free in virtio_net_del_queue() function, when removing virtio-net queues if the guest doesn't support multiqueue. But it might be still referenced by virtio_net_set_status(), which needs to be set NULL. And also the tx_waiting needs to be set zero to prevent virtio_net_set_status() accessing tx_bh or tx_timer. Cc: qemu-stable@nongnu.org Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
-rw-r--r--hw/net/virtio-net.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7d091c9259..98bd683f31 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1522,9 +1522,12 @@ static void virtio_net_del_queue(VirtIONet *n, int index)
if (q->tx_timer) {
timer_del(q->tx_timer);
timer_free(q->tx_timer);
+ q->tx_timer = NULL;
} else {
qemu_bh_delete(q->tx_bh);
+ q->tx_bh = NULL;
}
+ q->tx_waiting = 0;
virtio_del_queue(vdev, index * 2 + 1);
}