[Qemu-devel] [PATCH] usb: fix usb-net segfault

[Qemu-devel] [PATCH] usb: fix usb-net segfault

[Michal Kazior]

The dev->config pointer isn't set until guest
system initializes usb devices (via
usb_desc_set_config). However qemu networking can
go through some motions prior to that, e.g.:

 #0  is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653
 #1  0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315
 #2  0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470
 #3  0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101
 #4  0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470
 #5  0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172

The command to reproduce most reliably was:

 qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0

This wasn't strictly a problem with tap. Other
networking endpoints (vde, user) could trigger
this problem as well.

Fixes: https://bugs.launchpad.net/qemu/+bug/1050823
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
---
 hw/usb/dev-network.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 18669917f564..9be3a64006f4 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1310,6 +1310,10 @@ static int usbnet_can_receive(NetClientState *nc)
 {
     USBNetState *s = qemu_get_nic_opaque(nc);
 
+    if (!s->dev.config) {
+        return 0;
+    }
+
     if (is_rndis(s) && s->rndis_state != RNDIS_DATA_INITIALIZED) {
         return 1;
     }
-- 
2.1.4

Re: [Qemu-devel] [PATCH] usb: fix usb-net segfault

[Gerd Hoffmann]

On Mi, 2015-04-29 at 11:34 +0000, Michal Kazior wrote:
> The dev->config pointer isn't set until guest
> system initializes usb devices (via
> usb_desc_set_config). However qemu networking can
> go through some motions prior to that, e.g.:
> 
>  #0  is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653
>  #1  0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315
>  #2  0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470
>  #3  0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101
>  #4  0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470
>  #5  0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172
> 
> The command to reproduce most reliably was:
> 
>  qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0
> 
> This wasn't strictly a problem with tap. Other
> networking endpoints (vde, user) could trigger
> this problem as well.

added to usb queue.

thanks,
  Gerd