Re: [Qemu-devel] [PATCH 2/3] slirp: Fix requeuing of batchq packets in if_start

[Stefan Weil]

Am 17.02.2012 16:45, schrieb Jan Kiszka:
> In case we requeued a packet that was the head of a longer session
> queue, we failed to restore this ordering. Also, we did not properly
> deal with changes to Slirp::next_m.
>
> Instead of a cumbersome roll back, this fix simply avoids any changes
> until we know if the packet was actually sent. Both fixes crashes due
> to inconsistent queues and simplifies the logic.
>
> Thanks to Zhi Yong Wu who found the reason for these crashes.
>
> CC: Zhi Yong Wu <address@hidden>
> CC: Fabien Chouteau <address@hidden>
> Signed-off-by: Jan Kiszka <address@hidden>
> ---
> slirp/if.c | 35 +++++++++++++++++++----------------
> 1 files changed, 19 insertions(+), 16 deletions(-)

Latest QEMU crashed here 4 times with MIPS Malta
when I tried 'apt-get update' in the guest. See gdb output
below for details.

I only got the crash with big endian MIPS, not with little
endian which is strange.

After I reverted the above patch, MIPS Malta worked
again as before.

So maybe we changed one crash against a new one.

Regards,

Stefan Weil


Program received signal SIGSEGV, Segmentation fault.
0x000055555577b2a4 in ifs_insque (ifm=0x555556eb0e10, ifmhead=0x0) at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/if.c:14
14              ifm->ifs_next = ifmhead->ifs_next;
(gdb) p ifmhead
$1 = (struct mbuf *) 0x0
(gdb) l
9       #include "qemu-timer.h"
10
11      static void
12      ifs_insque(struct mbuf *ifm, struct mbuf *ifmhead)
13      {
14              ifm->ifs_next = ifmhead->ifs_next;
15              ifmhead->ifs_next = ifm;
16              ifm->ifs_prev = ifmhead;
17              ifm->ifs_next->ifs_prev = ifm;
18      }
(gdb) i s
#0  0x000055555577b2a4 in ifs_insque (ifm=0x555556eb0e10, ifmhead=0x0) 
at /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/if.c:14
#1  0x000055555577b487 in if_output (so=0x555556ea0bd0, 
ifm=0x555556eb0e10) at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/if.c:81
#2  0x000055555577cf2c in ip_output (so=0x555556ea0bd0, 
m0=0x555556eb0e10) at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/ip_output.c:84
#3  0x00005555557863f2 in tcp_output (tp=0x555556ea0c80) at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/tcp_output.c:456
#4  0x000055555577fd66 in slirp_select_poll (readfds=0x7fffffffda10, 
writefds=0x7fffffffda90, xfds=0x7fffffffdb10, select_error=0)
    at /home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/slirp.c:477
#5  0x000055555572d8c0 in main_loop_wait (nonblocking=1) at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/main-loop.c:469
#6  0x0000555555721a61 in main_loop () at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/vl.c:1558
#7  0x00005555557284a2 in main (argc=25, argv=0x7fffffffdfe8, 
envp=0x7fffffffe0b8) at /home/stefan/src/qemu/repo.or.cz/qemu/ar7/vl.c:3667
(gdb) up
#1  0x000055555577b487 in if_output (so=0x555556ea0bd0, 
ifm=0x555556eb0e10) at 
/home/stefan/src/qemu/repo.or.cz/qemu/ar7/slirp/if.c:81
81                              ifs_insque(ifm, ifq->ifs_prev);
(gdb) p *ifq
$2 = {m_hdr = {mh_next = 0x5555564bfc48, mh_prev = 0x0, mh_nextpkt = 
0x0, mh_prevpkt = 0x0, mh_flags = 0, mh_size = 1562, mh_so = 
0x555556ea0bd0, mh_data = 0x555556eb0ea0 "E",
    mh_len = 1500}, slirp = 0x5555564bfb80, arp_requested = false, 
expiration_date = 18446744073709551615, M_dat = {m_dat_ = "", m_ext_ = 0x0}}