From 0cbd6e52215427f13dadcde4e58bce455519bb03 Mon Sep 17 00:00:00 2001 From: Akihiko Odaki Date: Thu, 23 Feb 2023 19:20:11 +0900 Subject: e1000e: Do not assert when MSI-X is disabled later Assertions will fail if MSI-X gets disabled while a timer for MSI-X interrupts is running so remove them to avoid abortions. Fortunately, nothing bad happens even if the assertions won't trigger as msix_notify(), called by timer handlers, does nothing when MSI-X is disabled. This bug was found by Alexander Bulekov when fuzzing igb, a new device implementation derived from e1000e: https://patchew.org/QEMU/20230129053316.1071513-1-alxndr@bu.edu/ The fixed test case is: fuzz/crash_aea040166819193cf9fedb810c6d100221da721a Fixes: 6f3fbe4ed0 ("net: Introduce e1000e device emulation") Signed-off-by: Akihiko Odaki Signed-off-by: Jason Wang --- hw/net/e1000e_core.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'hw') diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c index ff93547..76c7814 100644 --- a/hw/net/e1000e_core.c +++ b/hw/net/e1000e_core.c @@ -162,8 +162,6 @@ e1000e_intrmgr_on_throttling_timer(void *opaque) { E1000IntrDelayTimer *timer = opaque; - assert(!msix_enabled(timer->core->owner)); - timer->running = false; if (msi_enabled(timer->core->owner)) { @@ -183,8 +181,6 @@ e1000e_intrmgr_on_msix_throttling_timer(void *opaque) E1000IntrDelayTimer *timer = opaque; int idx = timer - &timer->core->eitr[0]; - assert(msix_enabled(timer->core->owner)); - timer->running = false; trace_e1000e_irq_msix_notify_postponed_vec(idx); -- cgit v1.1