From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:49890)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <samuel.thibault@ens-lyon.org>) id 1c5K0e-0002Zr-6g
	for qemu-devel@nongnu.org; Fri, 11 Nov 2016 17:09:20 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <samuel.thibault@ens-lyon.org>) id 1c5K0Z-0001BI-8Q
	for qemu-devel@nongnu.org; Fri, 11 Nov 2016 17:09:20 -0500
Received: from hera.aquilenet.fr ([141.255.128.1]:42408)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <samuel.thibault@ens-lyon.org>) id 1c5K0Z-0001AT-2H
	for qemu-devel@nongnu.org; Fri, 11 Nov 2016 17:09:15 -0500
Date: Fri, 11 Nov 2016 23:09:11 +0100
From: Samuel Thibault <samuel.thibault@gnu.org>
Message-ID: <20161111220911.GC2417@var.home>
References: <20161104111419.GG9817@stefanha-x1.localdomain>
	<20161106180401.GE27308@var.home>
	<e003d356-924b-3847-40a3-514d9ff1b787@pobox.com>
	<20161107104245.GC5036@stefanha-x1.localdomain>
	<466003bb-a2c4-bb9b-7b0b-7b2d6dcb16d7@pobox.com>
	<20161109112724.GC4682@stefanha-x1.localdomain>
	<b8a33819-5fc2-02f5-ec9b-b085a42671f2@pobox.com>
	<02eee090-b017-dd4e-e63c-814d3d7beb72@pobox.com>
	<20161111161705.GE2417@var.home>
	<d0abe16e-4a34-50b5-8298-eb798276b602@pobox.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="E/DnYTRukya0zdZ1"
Content-Disposition: inline
In-Reply-To: <d0abe16e-4a34-50b5-8298-eb798276b602@pobox.com>
Subject: Re: [Qemu-devel] Crashing in tcp_close
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Brian Candler <b.candler@pobox.com>
Cc: Stefan Hajnoczi <stefanha@gmail.com>, qemu-devel@nongnu.org, Jan Kiszka <jan.kiszka@siemens.com>


--E/DnYTRukya0zdZ1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Brian Candler, on Fri 11 Nov 2016 20:53:12 +0000, wrote:
> On 11/11/2016 16:17, Samuel Thibault wrote:
> >Could you increase the value given to valgrind's --num-callers= so we
> >can make sure the context of this call?
> 
> OK: re-run with --num-callers=250. It took a few iterations, but I captured
> it again. (I have grepped out all the "invalid file descriptor" lines).

Thanks!

> ==1217== Thread 1:
> ==1217== Invalid read of size 4
> ==1217==    at 0x550B5B: if_start (if.c:230)
> ==1217==    by 0x5550E2: slirp_pollfds_poll (slirp.c:770)
> ==1217==    by 0x5891EB: main_loop_wait (main-loop.c:508)
> ==1217==    by 0x2F4430: main_loop (vl.c:1908)
> ==1217==    by 0x2F4430: main (vl.c:4604)

Ooh, I see.  Now it's obvious, now that it's not coming from the tcb
loop :) Could you try the attached patch?

Samuel

--E/DnYTRukya0zdZ1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=patch

diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..1a50d30 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,13 @@ void
 sofree(struct socket *so)
 {
   Slirp *slirp = so->slirp;
+  struct mbuf *ifm;
+
+  for (ifm = slirp->next_m; ifm; ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
 
   if (so->so_emu==EMU_RSH && so->extra) {
 	sofree(so->extra);

--E/DnYTRukya0zdZ1--