[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 47/55] virtio-net: don't touch virtqueue if vm is st
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 47/55] virtio-net: don't touch virtqueue if vm is stopped |
Date: |
Wed, 6 Dec 2017 13:16:40 -0600 |
From: Jason Wang <address@hidden>
Guest state should not be touched if VM is stopped, unfortunately we
didn't check running state and tried to drain tx queue unconditionally
in virtio_net_set_status(). A crash was then noticed as a migration
destination when user type quit after virtqueue state is loaded but
before region cache is initialized. In this case,
virtio_net_drop_tx_queue_data() tries to access the uninitialized
region cache.
Fix this by only dropping tx queue data when vm is running.
Fixes: 283e2c2adcb80 ("net: virtio-net discards TX data after link down")
Cc: Yuri Benditovich <address@hidden>
Cc: Paolo Bonzini <address@hidden>
Cc: Stefan Hajnoczi <address@hidden>
Cc: Michael S. Tsirkin <address@hidden>
Cc: address@hidden
Reviewed-by: Stefan Hajnoczi <address@hidden>
Signed-off-by: Jason Wang <address@hidden>
(cherry picked from commit 70e53e6e4da3db4b2c31981191753a7e974936d0)
Signed-off-by: Michael Roth <address@hidden>
---
hw/net/virtio-net.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 148071a396..fbc5e1bd73 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -288,7 +288,8 @@ static void virtio_net_set_status(struct VirtIODevice
*vdev, uint8_t status)
qemu_bh_cancel(q->tx_bh);
}
if ((n->status & VIRTIO_NET_S_LINK_UP) == 0 &&
- (queue_status & VIRTIO_CONFIG_S_DRIVER_OK)) {
+ (queue_status & VIRTIO_CONFIG_S_DRIVER_OK) &&
+ vdev->vm_running) {
/* if tx is waiting we are likely have some packets in tx queue
* and disabled notification */
q->tx_waiting = 0;
--
2.11.0
- [Qemu-devel] [PATCH 30/55] qcow2: Always execute preallocate() in a coroutine, (continued)
- [Qemu-devel] [PATCH 30/55] qcow2: Always execute preallocate() in a coroutine, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 31/55] iotests: Add cluster_size=64k to 125, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 36/55] hw/intc/arm_gicv3_its: Don't abort on table save failure, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 40/55] util/stats64: Fix min/max comparisons, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 38/55] net: fix check for number of parameters to -netdev socket, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 37/55] net/socket: fix coverity issue, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 35/55] translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 39/55] nbd/client: Use error_prepend() correctly, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 03/55] block/mirror: check backing in bdrv_mirror_top_flush, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 41/55] virtio: Add queue interface to restore avail index from vring used index, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 47/55] virtio-net: don't touch virtqueue if vm is stopped,
Michael Roth <=
- [Qemu-devel] [PATCH 48/55] nbd/server: CVE-2017-15119 Reject options larger than 32M, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 42/55] vhost: restore avail index from vring used index on disconnection, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 44/55] spapr: reset DRCs after devices, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 46/55] block/nfs: fix nfs_client_open for filesize greater than 1TB, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 50/55] vhost: fix error check in vhost_verify_ring_mappings(), Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 43/55] hw/ppc: clear pending_events on machine reset, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 49/55] nbd/server: CVE-2017-15118 Stack smash on large export name, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 45/55] scripts/make-release: ship u-boot source as a tarball, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 04/55] kvmclock: use the updated system_timer_msr, Michael Roth, 2017/12/06
- [Qemu-devel] [PATCH 52/55] nbd-client: Refuse read-only client with BDRV_O_RDWR, Michael Roth, 2017/12/06