Brian Candler, on Fri 11 Nov 2016 20:53:12 +0000, wrote:
> On 11/11/2016 16:17, Samuel Thibault wrote:
> >Could you increase the value given to valgrind's --num-callers= so we
> >can make sure the context of this call?
>
> OK: re-run with --num-callers=250. It took a few iterations, but I captured
> it again. (I have grepped out all the "invalid file descriptor" lines).
Thanks!
> ==1217== Thread 1:
> ==1217== Invalid read of size 4
> ==1217== at 0x550B5B: if_start (if.c:230)
> ==1217== by 0x5550E2: slirp_pollfds_poll (slirp.c:770)
> ==1217== by 0x5891EB: main_loop_wait (main-loop.c:508)
> ==1217== by 0x2F4430: main_loop (vl.c:1908)
> ==1217== by 0x2F4430: main (vl.c:4604)
Ooh, I see. Now it's obvious, now that it's not coming from the tcb
loop :) Could you try the attached patch?
Samuel
diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..1a50d30 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,13 @@ void
sofree(struct socket *so)
{
Slirp *slirp = so->slirp;
+ struct mbuf *ifm;
+
+ for (ifm = slirp->next_m; ifm; ifm = ifm->ifq_next) {
+ if (ifm->ifq_so == so) {
+ ifm->ifq_so = NULL;
+ }
+ }
if (so->so_emu==EMU_RSH && so->extra) {
sofree(so->extra);
