From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33545) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anHvb-0000bL-FB for qemu-devel@nongnu.org; Mon, 04 Apr 2016 23:45:20 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1anHvY-0007ux-Ph for qemu-devel@nongnu.org; Mon, 04 Apr 2016 23:45:19 -0400 Received: from szxga01-in.huawei.com ([58.251.152.64]:38620) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1anHvW-0007oQ-DA for qemu-devel@nongnu.org; Mon, 04 Apr 2016 23:45:16 -0400 From: zhanghailiang Date: Tue, 5 Apr 2016 11:43:55 +0800 Message-ID: <1459827835-7524-1-git-send-email-zhang.zhanghailiang@huawei.com> MIME-Version: 1.0 Content-Type: text/plain Subject: [Qemu-devel] [PATCH v2] filter-buffer: fix segfault when starting qemu with status=off property List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: jasowang@redhat.com, zhanghailiang After commit 338d3f, we support 'status' property for filter object. The segfault can be triggered by starting qemu with 'status=off' property for filter, when the s->incoming_queue is NULL, we reference it directly in qemu_net_queue_flush() which was called in status_changed() callback function. We shouldn't trigger status_changed() before the filter was initialized, We can check the value of 'nf->netdev' to confirm if the filter is initialized or not, so let's check its value before calling status_changed(). Signed-off-by: zhanghailiang --- v2: - fix the segfault by skipping calling status_changed() if the filter is not initialized. (Jason Wang's suggestion) --- net/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/filter.c b/net/filter.c index 1c4fc5a..8ac79f3 100644 --- a/net/filter.c +++ b/net/filter.c @@ -164,7 +164,7 @@ static void netfilter_set_status(Object *obj, const char *str, Error **errp) return; } nf->on = !nf->on; - if (nfc->status_changed) { + if (nf->netdev && nfc->status_changed) { nfc->status_changed(nf, errp); } } -- 1.8.3.1