[Qemu-devel] [PATCH v2] filter-buffer: fix segfault when starting qemu with status=off property

[Qemu-devel] [PATCH v2] filter-buffer: fix segfault when starting qemu with status=off property

[zhanghailiang]

After commit 338d3f, we support 'status' property for filter object.
The segfault can be triggered by starting qemu with 'status=off' property
for filter, when the s->incoming_queue is NULL, we reference it directly
in qemu_net_queue_flush() which was called in status_changed() callback
function.

We shouldn't trigger status_changed() before the filter was initialized,
We can check the value of 'nf->netdev' to confirm if the filter is
initialized or not, so let's check its value before calling
status_changed().

Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
---
v2:
 - fix the segfault by skipping calling status_changed() if the filter
   is not initialized. (Jason Wang's suggestion)
---
 net/filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/filter.c b/net/filter.c
index 1c4fc5a..8ac79f3 100644
--- a/net/filter.c
+++ b/net/filter.c
@@ -164,7 +164,7 @@ static void netfilter_set_status(Object *obj, const char *str, Error **errp)
         return;
     }
     nf->on = !nf->on;
-    if (nfc->status_changed) {
+    if (nf->netdev && nfc->status_changed) {
         nfc->status_changed(nf, errp);
     }
 }
-- 
1.8.3.1

Re: [Qemu-devel] [PATCH v2] filter-buffer: fix segfault when starting qemu with status=off property

[Jason Wang]

On 04/05/2016 11:43 AM, zhanghailiang wrote:
> After commit 338d3f, we support 'status' property for filter object.
> The segfault can be triggered by starting qemu with 'status=off' property
> for filter, when the s->incoming_queue is NULL, we reference it directly
> in qemu_net_queue_flush() which was called in status_changed() callback
> function.
>
> We shouldn't trigger status_changed() before the filter was initialized,
> We can check the value of 'nf->netdev' to confirm if the filter is
> initialized or not, so let's check its value before calling
> status_changed().
>
> Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
> ---
> v2:
>  - fix the segfault by skipping calling status_changed() if the filter
>    is not initialized. (Jason Wang's suggestion)
> ---
>  net/filter.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/filter.c b/net/filter.c
> index 1c4fc5a..8ac79f3 100644
> --- a/net/filter.c
> +++ b/net/filter.c
> @@ -164,7 +164,7 @@ static void netfilter_set_status(Object *obj, const char *str, Error **errp)
>          return;
>      }
>      nf->on = !nf->on;
> -    if (nfc->status_changed) {
> +    if (nf->netdev && nfc->status_changed) {
>          nfc->status_changed(nf, errp);
>      }
>  }

Applied to -net.

Thanks