From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49508) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZKm8F-0007BJ-Pn for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:36:18 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZKm8C-0002yc-Jz for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:36:15 -0400 Received: from e17.ny.us.ibm.com ([129.33.205.207]:39431) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZKm8C-0002yL-5g for qemu-devel@nongnu.org; Thu, 30 Jul 2015 07:36:12 -0400 Received: from /spool/local by e17.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 30 Jul 2015 07:36:11 -0400 From: Michael Roth Date: Thu, 30 Jul 2015 06:32:23 -0500 Message-Id: <1438255988-10418-9-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1438255988-10418-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1438255988-10418-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 08/53] usb: fix usb-net segfault List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Gerd Hoffmann , qemu-stable@nongnu.org, Michal Kazior From: Michal Kazior The dev->config pointer isn't set until guest system initializes usb devices (via usb_desc_set_config). However qemu networking can go through some motions prior to that, e.g.: #0 is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653 #1 0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315 #2 0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470 #3 0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101 #4 0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470 #5 0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172 The command to reproduce most reliably was: qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0 This wasn't strictly a problem with tap. Other networking endpoints (vde, user) could trigger this problem as well. Fixes: https://bugs.launchpad.net/qemu/+bug/1050823 Cc: qemu-stable@nongnu.org Signed-off-by: Michal Kazior Signed-off-by: Gerd Hoffmann (cherry picked from commit 278412d0e710e2e848c6e510f8308e5b1ed4d03e) Signed-off-by: Michael Roth --- hw/usb/dev-network.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c index 1866991..9be3a64 100644 --- a/hw/usb/dev-network.c +++ b/hw/usb/dev-network.c @@ -1310,6 +1310,10 @@ static int usbnet_can_receive(NetClientState *nc) { USBNetState *s = qemu_get_nic_opaque(nc); + if (!s->dev.config) { + return 0; + } + if (is_rndis(s) && s->rndis_state != RNDIS_DATA_INITIALIZED) { return 1; } -- 1.9.1