0a122b
From 3c47b10c7a3a86d6fb5fb15a0c41fe512ed44f87 Mon Sep 17 00:00:00 2001
0a122b
From: Xiao Wang <jasowang@redhat.com>
0a122b
Date: Thu, 14 Nov 2013 09:40:26 +0100
0a122b
Subject: [PATCH 02/14] virtio-net: only delete bh that existed
0a122b
0a122b
RH-Author: Xiao Wang <jasowang@redhat.com>
0a122b
Message-id: <1384422026-7632-1-git-send-email-jasowang@redhat.com>
0a122b
Patchwork-id: 55681
0a122b
O-Subject: [RHEL7.0 qemu-kvm PATCH] virtio-net: only delete bh that existed
0a122b
Bugzilla: 922463
0a122b
RH-Acked-by: Amos Kong <akong@redhat.com>
0a122b
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
0a122b
RH-Acked-by: Markus Armbruster <armbru@redhat.com>
0a122b
RH-Acked-by: Vlad Yasevich <vyasevic@redhat.com>
0a122b
0a122b
bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=922463
0a122b
upstream: 6b9b8758c15f3bc2875dbd6e2d03c5362b8d6902
0a122b
brew build: https://brewweb.devel.redhat.com/taskinfo?taskID=6576713
0a122b
test status: tested by my self
0a122b
0a122b
We delete without check whether it existed during exit. This will lead NULL
0a122b
pointer deference since it was created conditionally depends on guest driver
0a122b
status and features. So add a check of existence before trying to delete it.
0a122b
0a122b
Cc: qemu-stable@nongnu.org
0a122b
Signed-off-by: Jason Wang <jasowang@redhat.com>
0a122b
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
0a122b
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
0a122b
---
0a122b
 hw/net/virtio-net.c |    2 +-
0a122b
 1 files changed, 1 insertions(+), 1 deletions(-)
0a122b
0a122b
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
0a122b
---
0a122b
 hw/net/virtio-net.c |    2 +-
0a122b
 1 files changed, 1 insertions(+), 1 deletions(-)
0a122b
0a122b
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
0a122b
index 19c5030..f889841 100644
0a122b
--- a/hw/net/virtio-net.c
0a122b
+++ b/hw/net/virtio-net.c
0a122b
@@ -1532,7 +1532,7 @@ static int virtio_net_device_exit(DeviceState *qdev)
0a122b
         if (q->tx_timer) {
0a122b
             qemu_del_timer(q->tx_timer);
0a122b
             qemu_free_timer(q->tx_timer);
0a122b
-        } else {
0a122b
+        } else if (q->tx_bh) {
0a122b
             qemu_bh_delete(q->tx_bh);
0a122b
         }
0a122b
     }
0a122b
-- 
0a122b
1.7.1
0a122b