Thomas Huth, on mer. 30 août 2017 09:50:45 +0200, wrote:
> On 26.08.2017 00:37, Samuel Thibault wrote:
> > The if_fastq and if_batchq contain not only packets, but queues of packets
> > for the same socket. When sofree frees a socket, it thus has to clear ifq_so
> > from all the packets from the queues, not only the first.
>
> I think you should CC: this to qemu-stable if it's fixing a problem that
> can be used by the guest to crash QEMU... ?
Indeed. I thought it should first go to master.
Samuel
> Thomas
>
> > Signed-off-by: Samuel Thibault <samuel.thiba...@ens-lyon.org>
> > Acked-by: Philippe Mathieu-Daudé <f4...@amsat.org>
> > ---
> > slirp/socket.c | 39 +++++++++++++++++++++++----------------
> > 1 file changed, 23 insertions(+), 16 deletions(-)
> >
> > diff --git a/slirp/socket.c b/slirp/socket.c
> > index ecec0295a9..cb7b5b608d 100644
> > --- a/slirp/socket.c
> > +++ b/slirp/socket.c
> > @@ -59,6 +59,27 @@ socreate(Slirp *slirp)
> > return(so);
> > }
> >
> > +/*
> > + * Remove references to so from the given message queue.
> > + */
> > +static void
> > +soqfree(struct socket *so, struct quehead *qh)
> > +{
> > + struct mbuf *ifq;
> > +
> > + for (ifq = (struct mbuf *) qh->qh_link;
> > + (struct quehead *) ifq != qh;
> > + ifq = ifq->ifq_next) {
> > + if (ifq->ifq_so == so) {
> > + struct mbuf *ifm;
> > + ifq->ifq_so = NULL;
> > + for (ifm = ifq->ifs_next; ifm != ifq; ifm = ifm->ifs_next) {
> > + ifm->ifq_so = NULL;
> > + }
> > + }
> > + }
> > +}
> > +
> > /*
> > * remque and free a socket, clobber cache
> > */
> > @@ -66,23 +87,9 @@ void
> > sofree(struct socket *so)
> > {
> > Slirp *slirp = so->slirp;
> > - struct mbuf *ifm;
> >
> > - for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
> > - (struct quehead *) ifm != &slirp->if_fastq;
> > - ifm = ifm->ifq_next) {
> > - if (ifm->ifq_so == so) {
> > - ifm->ifq_so = NULL;
> > - }
> > - }
> > -
> > - for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
> > - (struct quehead *) ifm != &slirp->if_batchq;
> > - ifm = ifm->ifq_next) {
> > - if (ifm->ifq_so == so) {
> > - ifm->ifq_so = NULL;
> > - }
> > - }
> > + soqfree(so, &slirp->if_fastq);
> > + soqfree(so, &slirp->if_batchq);
> >
> > if (so->so_emu==EMU_RSH && so->extra) {
> > sofree(so->extra);
> >
>
--
Samuel
CN > J'ai enseigné l'algorythmique.
GLG> C'est quoi l'algorythmique ? Une contrebasse programmée en Algol ?
-+- in : Guide du Neuneu d'Usenet - Neuneu fait ses gammes. -+-
