[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] virtio-net: fix wild pointer when remove virtio

From: Jason Wang
Subject: Re: [Qemu-devel] [PATCH] virtio-net: fix wild pointer when remove virtio-net queues
Date: Wed, 26 Apr 2017 17:17:46 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0

On 2017年04月26日 14:45, Yunjian Wang wrote:
The tx_bh or tx_timer will free in virtio_net_del_queue() function, when
removing virtio-net queues if the guest doesn't support multiqueue. But
it might be still referenced by virtio_net_set_status(), which needs to
be set NULL. And also the tx_waiting needs to be set zero to prevent
virtio_net_set_status() accessing tx_bh or tx_timer.

Signed-off-by: Yunjian Wang <address@hidden>
  hw/net/virtio-net.c | 3 +++
  1 file changed, 3 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7d091c9..98bd683 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1522,9 +1522,12 @@ static void virtio_net_del_queue(VirtIONet *n, int index)
      if (q->tx_timer) {
+        q->tx_timer = NULL;
      } else {
+        q->tx_bh = NULL;
+    q->tx_waiting = 0;
      virtio_del_queue(vdev, index * 2 + 1);

Thanks for the patch.

It looks to me that clearing tx_waiting is sufficient or is there any other reason that you need set tx_timer/tx_bh to NULL?


reply via email to

[Prev in Thread] Current Thread [Next in Thread]