From: Yunjian Wang <wangyunj...@huawei.com> The tx_bh or tx_timer will free in virtio_net_del_queue() function, when removing virtio-net queues if the guest doesn't support multiqueue. But it might be still referenced by virtio_net_set_status(), which needs to be set NULL. And also the tx_waiting needs to be set zero to prevent virtio_net_set_status() accessing tx_bh or tx_timer.
Cc: qemu-sta...@nongnu.org Signed-off-by: Yunjian Wang <wangyunj...@huawei.com> Signed-off-by: Jason Wang <jasow...@redhat.com> (cherry picked from commit f989c30cf834ba8625e98b808eac30e4e7ec5008) Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com> --- hw/net/virtio-net.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index 7d091c9..98bd683 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1522,9 +1522,12 @@ static void virtio_net_del_queue(VirtIONet *n, int index) if (q->tx_timer) { timer_del(q->tx_timer); timer_free(q->tx_timer); + q->tx_timer = NULL; } else { qemu_bh_delete(q->tx_bh); + q->tx_bh = NULL; } + q->tx_waiting = 0; virtio_del_queue(vdev, index * 2 + 1); } -- 2.7.4