From 278412d0e710e2e848c6e510f8308e5b1ed4d03e Mon Sep 17 00:00:00 2001 From: Michal Kazior Date: Wed, 29 Apr 2015 11:34:59 +0000 Subject: usb: fix usb-net segfault The dev->config pointer isn't set until guest system initializes usb devices (via usb_desc_set_config). However qemu networking can go through some motions prior to that, e.g.: #0 is_rndis (s=0x555557261970) at hw/usb/dev-network.c:653 #1 0x000055555585f723 in usbnet_can_receive (nc=0x55555641e820) at hw/usb/dev-network.c:1315 #2 0x000055555587635e in qemu_can_send_packet (sender=0x5555572660a0) at net/net.c:470 #3 0x0000555555878e34 in net_hub_port_can_receive (nc=0x5555562d7800) at net/hub.c:101 #4 0x000055555587635e in qemu_can_send_packet (sender=0x5555562d7980) at net/net.c:470 #5 0x000055555587dbca in tap_can_send (opaque=0x5555562d7980) at net/tap.c:172 The command to reproduce most reliably was: qemu-system-i386 -usb -device usb-net,vlan=0 -net tap,vlan=0 This wasn't strictly a problem with tap. Other networking endpoints (vde, user) could trigger this problem as well. Fixes: https://bugs.launchpad.net/qemu/+bug/1050823 Cc: qemu-stable@nongnu.org Signed-off-by: Michal Kazior Signed-off-by: Gerd Hoffmann --- hw/usb/dev-network.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'hw/usb/dev-network.c') diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c index 18669917f5..9be3a64006 100644 --- a/hw/usb/dev-network.c +++ b/hw/usb/dev-network.c @@ -1310,6 +1310,10 @@ static int usbnet_can_receive(NetClientState *nc) { USBNetState *s = qemu_get_nic_opaque(nc); + if (!s->dev.config) { + return 0; + } + if (is_rndis(s) && s->rndis_state != RNDIS_DATA_INITIALIZED) { return 1; } -- cgit v1.2.3 From fe47db72210dc17b794954f978ef1d1236cbeb72 Mon Sep 17 00:00:00 2001 From: Gonglei Date: Wed, 6 May 2015 20:55:30 +0800 Subject: usb: usb-net QOMify Signed-off-by: Gonglei Signed-off-by: Gerd Hoffmann --- hw/usb/dev-network.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'hw/usb/dev-network.c') diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c index 9be3a64006..743c231d6b 100644 --- a/hw/usb/dev-network.c +++ b/hw/usb/dev-network.c @@ -648,6 +648,9 @@ typedef struct USBNetState { QTAILQ_HEAD(rndis_resp_head, rndis_response) rndis_resp; } USBNetState; +#define TYPE_USB_NET "usb-net" +#define USB_NET(obj) OBJECT_CHECK(USBNetState, (obj), TYPE_USB_NET) + static int is_rndis(USBNetState *s) { return s->dev.config->bConfigurationValue == DEV_RNDIS_CONFIG_VALUE; @@ -1347,7 +1350,7 @@ static NetClientInfo net_usbnet_info = { static void usb_net_realize(USBDevice *dev, Error **errrp) { - USBNetState *s = DO_UPCAST(USBNetState, dev, dev); + USBNetState *s = USB_NET(dev); usb_desc_create_serial(dev); usb_desc_init(dev); @@ -1380,7 +1383,7 @@ static void usb_net_realize(USBDevice *dev, Error **errrp) static void usb_net_instance_init(Object *obj) { USBDevice *dev = USB_DEVICE(obj); - USBNetState *s = DO_UPCAST(USBNetState, dev, dev); + USBNetState *s = USB_NET(dev); device_add_bootindex_property(obj, &s->conf.bootindex, "bootindex", "/ethernet-phy@0", @@ -1441,7 +1444,7 @@ static void usb_net_class_initfn(ObjectClass *klass, void *data) } static const TypeInfo net_info = { - .name = "usb-net", + .name = TYPE_USB_NET, .parent = TYPE_USB_DEVICE, .instance_size = sizeof(USBNetState), .class_init = usb_net_class_initfn, @@ -1451,7 +1454,7 @@ static const TypeInfo net_info = { static void usb_net_register_types(void) { type_register_static(&net_info); - usb_legacy_register("usb-net", "net", usb_net_init); + usb_legacy_register(TYPE_USB_NET, "net", usb_net_init); } type_init(usb_net_register_types) -- cgit v1.2.3