Re: [Qemu-devel] Crashing in tcp_close

[Samuel Thibault <samuel.thibault@gnu.org>]

[-- Attachment #1: Type: text/plain, Size: 819 bytes --]

Brian Candler, on Fri 11 Nov 2016 20:53:12 +0000, wrote:
> On 11/11/2016 16:17, Samuel Thibault wrote:
> >Could you increase the value given to valgrind's --num-callers= so we
> >can make sure the context of this call?
> 
> OK: re-run with --num-callers=250. It took a few iterations, but I captured
> it again. (I have grepped out all the "invalid file descriptor" lines).

Thanks!

> ==1217== Thread 1:
> ==1217== Invalid read of size 4
> ==1217==    at 0x550B5B: if_start (if.c:230)
> ==1217==    by 0x5550E2: slirp_pollfds_poll (slirp.c:770)
> ==1217==    by 0x5891EB: main_loop_wait (main-loop.c:508)
> ==1217==    by 0x2F4430: main_loop (vl.c:1908)
> ==1217==    by 0x2F4430: main (vl.c:4604)

Ooh, I see.  Now it's obvious, now that it's not coming from the tcb
loop :) Could you try the attached patch?

Samuel

[-- Attachment #2: patch --]
[-- Type: text/plain, Size: 415 bytes --]

diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..1a50d30 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,13 @@ void
 sofree(struct socket *so)
 {
   Slirp *slirp = so->slirp;
+  struct mbuf *ifm;
+
+  for (ifm = slirp->next_m; ifm; ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
 
   if (so->so_emu==EMU_RSH && so->extra) {
 	sofree(so->extra);