Commit f989c30c authored by Yunjian Wang's avatar Yunjian Wang Committed by Jason Wang
Browse files

virtio-net: fix wild pointer when remove virtio-net queues 



The tx_bh or tx_timer will free in virtio_net_del_queue() function, when
removing virtio-net queues if the guest doesn't support multiqueue. But
it might be still referenced by virtio_net_set_status(), which needs to
be set NULL. And also the tx_waiting needs to be set zero to prevent
virtio_net_set_status() accessing tx_bh or tx_timer.

Cc: qemu-stable@nongnu.org
Signed-off-by: default avatarYunjian Wang <wangyunjian@huawei.com>
Signed-off-by: default avatarJason Wang <jasowang@redhat.com>
parent f5ab20a4

hw/net/virtio-net.c

+3 −0
Original line number Diff line number Diff line
@@ -1522,9 +1522,12 @@ static void virtio_net_del_queue(VirtIONet *n, int index) 
    if (q->tx_timer) {

        timer_del(q->tx_timer);

        timer_free(q->tx_timer);

        q->tx_timer = NULL;

    } else {

        qemu_bh_delete(q->tx_bh);

        q->tx_bh = NULL;

    }

    q->tx_waiting = 0;

    virtio_del_queue(vdev, index * 2 + 1);

}