Re: [Qemu-devel] Crashing in tcp_close

[Samuel Thibault]

Hello,

Brian Candler, on Sat 12 Nov 2016 09:33:55 +0000, wrote:
> On 11/11/2016 22:09, Samuel Thibault wrote:
> >Ooh, I see.  Now it's obvious, now that it's not coming from the tcb
> >loop:)  Could you try the attached patch?
> 
> It looks like it now goes into an infinite loop when a connection is closed.

Oops, sorry, my patch was completely bogus, here is a proper one.

Samuel

diff --git a/slirp/socket.c b/slirp/socket.c
index 280050a..6c18971 100644
--- a/slirp/socket.c
+++ b/slirp/socket.c
@@ -66,6 +66,23 @@ void
 sofree(struct socket *so)
 {
   Slirp *slirp = so->slirp;
+  struct mbuf *ifm;
+
+  for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
+       (struct quehead *) ifm != &slirp->if_fastq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
+
+  for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
+       (struct quehead *) ifm != &slirp->if_batchq;
+       ifm = ifm->ifq_next) {
+    if (ifm->ifq_so == so) {
+      ifm->ifq_so = NULL;
+    }
+  }
 
   if (so->so_emu==EMU_RSH && so->extra) {
        sofree(so->extra);