virtio-net: validate backend queue numbers against bus limitation

We don't validate the backend queue numbers against bus limitation,
this will easily crash qemu if it exceeds the limitation which will
hit the abort() in virtio_del_queue(). An example is trying to
starting a virtio-net device with 256 queues. E.g:

./qemu-system-x86_64 -netdev tap,id=hn0,queues=256 -device
virtio-net-pci,netdev=hn0

Fixing this by doing the validation and fail early.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
1 file changed
tree: a3afabb60e43593737ee49276d8019384da7b5aa
  1. audio/
  2. backends/
  3. block/
  4. bsd-user/
  5. default-configs/
  6. disas/
  7. docs/
  8. fpu/
  9. fsdev/
  10. gdb-xml/
  11. hw/
  12. include/
  13. libcacard/
  14. libdecnumber/
  15. linux-headers/
  16. linux-user/
  17. migration/
  18. net/
  19. pc-bios/
  20. po/
  21. qapi/
  22. qga/
  23. qobject/
  24. qom/
  25. roms/
  26. scripts/
  27. slirp/
  28. stubs/
  29. sysconfigs/
  30. target-alpha/
  31. target-arm/
  32. target-cris/
  33. target-i386/
  34. target-lm32/
  35. target-m68k/
  36. target-microblaze/
  37. target-mips/
  38. target-moxie/
  39. target-openrisc/
  40. target-ppc/
  41. target-s390x/
  42. target-sh4/
  43. target-sparc/
  44. target-tricore/
  45. target-unicore32/
  46. target-xtensa/
  47. tcg/
  48. tests/
  49. trace/
  50. ui/
  51. util/
  52. .exrc
  53. .gitignore
  54. .gitmodules
  55. .mailmap
  56. .travis.yml
  57. accel.c
  58. aio-posix.c
  59. aio-win32.c
  60. arch_init.c
  61. async.c
  62. balloon.c
  63. block.c
  64. blockdev-nbd.c
  65. blockdev.c
  66. blockjob.c
  67. bootdevice.c
  68. bt-host.c
  69. bt-vhci.c
  70. Changelog
  71. CODING_STYLE
  72. configure
  73. COPYING
  74. COPYING.LIB
  75. coroutine-gthread.c
  76. coroutine-sigaltstack.c
  77. coroutine-ucontext.c
  78. coroutine-win32.c
  79. cpu-exec.c
  80. cpus.c
  81. cputlb.c
  82. device-hotplug.c
  83. device_tree.c
  84. disas.c
  85. dma-helpers.c
  86. dump.c
  87. exec.c
  88. gdbstub.c
  89. HACKING
  90. hmp-commands.hx
  91. hmp.c
  92. hmp.h
  93. iohandler.c
  94. ioport.c
  95. iothread.c
  96. kvm-all.c
  97. kvm-stub.c
  98. LICENSE
  99. main-loop.c
  100. MAINTAINERS
  101. Makefile
  102. Makefile.objs
  103. Makefile.target
  104. memory.c
  105. memory_mapping.c
  106. module-common.c
  107. monitor.c
  108. nbd.c
  109. numa.c
  110. os-posix.c
  111. os-win32.c
  112. page_cache.c
  113. qapi-schema.json
  114. qdev-monitor.c
  115. qdict-test-data.txt
  116. qemu-bridge-helper.c
  117. qemu-char.c
  118. qemu-coroutine-io.c
  119. qemu-coroutine-lock.c
  120. qemu-coroutine-sleep.c
  121. qemu-coroutine.c
  122. qemu-doc.texi
  123. qemu-img-cmds.hx
  124. qemu-img.c
  125. qemu-img.texi
  126. qemu-io-cmds.c
  127. qemu-io.c
  128. qemu-log.c
  129. qemu-nbd.c
  130. qemu-nbd.texi
  131. qemu-options-wrapper.h
  132. qemu-options.h
  133. qemu-options.hx
  134. qemu-seccomp.c
  135. qemu-tech.texi
  136. qemu-timer.c
  137. qemu.nsi
  138. qemu.sasl
  139. qjson.c
  140. qmp-commands.hx
  141. qmp.c
  142. qtest.c
  143. README
  144. rules.mak
  145. savevm.c
  146. softmmu_template.h
  147. spice-qemu-char.c
  148. tcg-runtime.c
  149. tci.c
  150. thread-pool.c
  151. thunk.c
  152. tpm.c
  153. trace-events
  154. translate-all.c
  155. translate-all.h
  156. user-exec.c
  157. VERSION
  158. version.rc
  159. vl.c
  160. xen-common-stub.c
  161. xen-common.c
  162. xen-hvm-stub.c
  163. xen-hvm.c
  164. xen-mapcache.c