aboutsummaryrefslogtreecommitdiff
path: root/hw/usb/dev-network.c
diff options
context:
space:
mode:
authorMichal Kazior <michal.kazior@tieto.com>2015-04-29 11:34:59 +0000
committerGerd Hoffmann <kraxel@redhat.com>2015-05-08 12:39:18 +0200
commit278412d0e710e2e848c6e510f8308e5b1ed4d03e (patch)
treeb7e664a8234e179e6e8034712d7813e24b7507ce /hw/usb/dev-network.c
parent838686357b1a175e9a32569700a153b207a9e10f (diff)
usb: fix usb-net segfault
The dev->config pointer isn't set until guest system initializes usb devices (via usb_desc_set_config). However qemu networking can go through some motions prior to that, e.g.: #0 is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653 #1 0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315 #2 0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470 #3 0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101 #4 0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470 #5 0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172 The command to reproduce most reliably was: qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0 This wasn't strictly a problem with tap. Other networking endpoints (vde, user) could trigger this problem as well. Fixes: https://bugs.launchpad.net/qemu/+bug/1050823 Cc: qemu-stable@nongnu.org Signed-off-by: Michal Kazior <michal.kazior@tieto.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/usb/dev-network.c')
-rw-r--r--hw/usb/dev-network.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 18669917f5..9be3a64006 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1310,6 +1310,10 @@ static int usbnet_can_receive(NetClientState *nc)
{
USBNetState *s = qemu_get_nic_opaque(nc);
+ if (!s->dev.config) {
+ return 0;
+ }
+
if (is_rndis(s) && s->rndis_state != RNDIS_DATA_INITIALIZED) {
return 1;
}