qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH for 2.11] virtio-net: don't touch virtqueue if vm is stopped
@ 2017-11-23  3:37 Jason Wang
  2017-11-23  4:09 ` no-reply
  2017-11-23 10:59 ` Stefan Hajnoczi
  0 siblings, 2 replies; 7+ messages in thread
From: Jason Wang @ 2017-11-23  3:37 UTC (permalink / raw)
  To: mst, jasowang, qemu-devel
  Cc: Yuri Benditovich, Paolo Bonzini, Stefan Hajnoczi, qemu-stable

Guest state should not be touched if VM is stopped, unfortunately we
didn't check running state and tried to drain tx queue unconditionally
in virtio_net_set_status(). A crash was then noticed as a migration
destination when user type quit after virtqueue state is loaded but
before region cache is initialized. In this case,
virtio_net_drop_tx_queue_data() tries to access the uninitialized
region cache.

Fix this by only dropping tx queue data when vm is running.

Fixes: 283e2c2adcb80 ("net: virtio-net discards TX data after link down")
Cc: Yuri Benditovich <yuri.benditovich@daynix.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 150fd07..38674b0 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -288,7 +288,8 @@ static void virtio_net_set_status(struct VirtIODevice *vdev, uint8_t status)
                 qemu_bh_cancel(q->tx_bh);
             }
             if ((n->status & VIRTIO_NET_S_LINK_UP) == 0 &&
-                (queue_status & VIRTIO_CONFIG_S_DRIVER_OK)) {
+                (queue_status & VIRTIO_CONFIG_S_DRIVER_OK) &&
+                vdev->vm_running) {
                 /* if tx is waiting we are likely have some packets in tx queue
                  * and disabled notification */
                 q->tx_waiting = 0;
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2017-11-27 11:19 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-11-23  3:37 [Qemu-devel] [PATCH for 2.11] virtio-net: don't touch virtqueue if vm is stopped Jason Wang
2017-11-23  4:09 ` no-reply
2017-11-23 10:59 ` Stefan Hajnoczi
2017-11-24  2:57   ` Jason Wang
2017-11-24 10:44     ` Stefan Hajnoczi
2017-11-27  3:26       ` Jason Wang
2017-11-27 11:19         ` Stefan Hajnoczi

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).