diff options
| author | Andrew Melnychenko <andrew@daynix.com> | 2020-03-04 16:20:58 +0200 |
|---|---|---|
| committer | Jason Wang <jasowang@redhat.com> | 2020-03-31 21:14:35 +0800 |
| commit | f22a57ac09abdd5afd8a974b52c19eda9347cffd (patch) | |
| tree | ab9df300fef1f1bc5eac40d5afe714bac67a3a9f | |
| parent | a43790f2f6155597e120409f467a3d41de3cfb53 (diff) | |
| download | qemu-f22a57ac09abdd5afd8a974b52c19eda9347cffd.zip qemu-f22a57ac09abdd5afd8a974b52c19eda9347cffd.tar.gz qemu-f22a57ac09abdd5afd8a974b52c19eda9347cffd.tar.bz2 | |
Fixed integer overflow in e1000e
Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400
Fixed setting max_queue_num if there are no peers in
NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index
0) without peers, set max_queue_num to 0 - It prevents undefined
behavior and possible crashes, especially during pcie hotplug.
Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation")
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
| -rw-r--r-- | hw/net/e1000e.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c index a91dbdc..f2cc155 100644 --- a/hw/net/e1000e.c +++ b/hw/net/e1000e.c @@ -328,7 +328,7 @@ e1000e_init_net_peer(E1000EState *s, PCIDevice *pci_dev, uint8_t *macaddr) s->nic = qemu_new_nic(&net_e1000e_info, &s->conf, object_get_typename(OBJECT(s)), dev->id, s); - s->core.max_queue_num = s->conf.peers.queues - 1; + s->core.max_queue_num = s->conf.peers.queues ? s->conf.peers.queues - 1 : 0; trace_e1000e_mac_set_permanent(MAC_ARG(macaddr)); memcpy(s->core.permanent_mac, macaddr, sizeof(s->core.permanent_mac)); |