virtio-net: fix wild pointer when remove virtio-net queues

[mirror_qemu.git] / hw / net / virtio-net.c

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index c32168077a6d6d8fbcff19a0134f9aa4703cc7c0..98bd683f31b51892877a3118a5df54dd99d67118 100644 (file)
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -510,6 +510,10 @@ static int peer_attach(VirtIONet *n, int index)
         return 0;
     }
 
+    if (n->max_queues == 1) {
+        return 0;
+    }
+
     return tap_enable(nc->peer);
 }
 
@@ -1518,9 +1522,12 @@ static void virtio_net_del_queue(VirtIONet *n, int index)
     if (q->tx_timer) {
         timer_del(q->tx_timer);
         timer_free(q->tx_timer);
+        q->tx_timer = NULL;
     } else {
         qemu_bh_delete(q->tx_bh);
+        q->tx_bh = NULL;
     }
+    q->tx_waiting = 0;
     virtio_del_queue(vdev, index * 2 + 1);
 }