From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:38268)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <samuel.thibault@ens-lyon.org>) id 1c5VnG-0006kX-Vf
	for qemu-devel@nongnu.org; Sat, 12 Nov 2016 05:44:19 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <samuel.thibault@ens-lyon.org>) id 1c5VnG-0000Q3-7Q
	for qemu-devel@nongnu.org; Sat, 12 Nov 2016 05:44:19 -0500
Received: from hera.aquilenet.fr ([2a01:474::1]:40529)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <samuel.thibault@ens-lyon.org>) id 1c5VnG-0000Pp-15
	for qemu-devel@nongnu.org; Sat, 12 Nov 2016 05:44:18 -0500
Date: Sat, 12 Nov 2016 11:44:15 +0100
From: Samuel Thibault <samuel.thibault@gnu.org>
Message-ID: <20161112104415.GR2417@var.home>
References: <e003d356-924b-3847-40a3-514d9ff1b787@pobox.com>
	<20161107104245.GC5036@stefanha-x1.localdomain>
	<466003bb-a2c4-bb9b-7b0b-7b2d6dcb16d7@pobox.com>
	<20161109112724.GC4682@stefanha-x1.localdomain>
	<b8a33819-5fc2-02f5-ec9b-b085a42671f2@pobox.com>
	<02eee090-b017-dd4e-e63c-814d3d7beb72@pobox.com>
	<20161111161705.GE2417@var.home>
	<d0abe16e-4a34-50b5-8298-eb798276b602@pobox.com>
	<20161111220911.GC2417@var.home>
	<07abcfd1-cff0-015d-90fb-f992b7328547@pobox.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="DiL7RhKs8rK9YGuF"
Content-Disposition: inline
In-Reply-To: <07abcfd1-cff0-015d-90fb-f992b7328547@pobox.com>
Subject: Re: [Qemu-devel] Crashing in tcp_close
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel/>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Brian Candler <b.candler@pobox.com>
Cc: Stefan Hajnoczi <stefanha@gmail.com>, qemu-devel@nongnu.org, Jan Kiszka <jan.kiszka@siemens.com>


--DiL7RhKs8rK9YGuF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hello,

Brian Candler, on Sat 12 Nov 2016 09:33:55 +0000, wrote:
> On 11/11/2016 22:09, Samuel Thibault wrote:
> >Ooh, I see.  Now it's obvious, now that it's not coming from the tcb
> >loop:)  Could you try the attached patch?
> 
> It looks like it now goes into an infinite loop when a connection is closed.

Oops, sorry, my patch was completely bogus, here is a proper one.

Samuel

--DiL7RhKs8rK9YGuF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=patch

diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..6c18971 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,23 @@ void
 sofree(struct socket *so)
 {
   Slirp *slirp = so->slirp;
+  struct mbuf *ifm;
+
+  for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
+       (struct quehead *) ifm != &slirp->if_fastq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
+
+  for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
+       (struct quehead *) ifm != &slirp->if_batchq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
 
   if (so->so_emu==EMU_RSH && so->extra) {
 	sofree(so->extra);

--DiL7RhKs8rK9YGuF--