Zhang, Xiantao wrote:
Scott Pakin wrote:
The attached patch corrects a bug in qemu/slirp/tcp_var.h that defines
the seg_next field in struct tcpcb to be 32 bits wide regardless of
32/64-bitness. seg_next is assigned a pointer value in
qemu/slirp/tcp_subr.c, then cast back to a pointer in
qemu/slirp/tcp_input.c and dereferenced. That produces a SIGSEGV on
my system.
I still hit it on IA64 platform with your patch, once configured with
slirp.
Okay, here's a more thorough patch that fixes *all* of the "cast from/to
pointer to/from integer of a different size" mistakes that gcc warns
about. Does it also solve the SIGSEGV problem on IA64?
-- Scott
================== BEGIN tcp_int32_pointer_cast.patch ==================
diff -Naur kvm-60-ORIG/qemu/exec-all.h kvm-60/qemu/exec-all.h
--- kvm-60-ORIG/qemu/exec-all.h 2008-01-20 05:35:04.000000000 -0700
+++ kvm-60/qemu/exec-all.h 2008-01-29 19:19:45.000000000 -0700
@@ -169,7 +169,7 @@
#ifdef USE_DIRECT_JUMP
uint16_t tb_jmp_offset[4]; /* offset of jump instruction */
#else
- uint32_t tb_next[2]; /* address of jump generated code */
+ uintptr_t tb_next[2]; /* address of jump generated code */
#endif
/* list of TBs jumping to this one. This is a circular list using
the two least significant bits of the pointers to tell what is
diff -Naur kvm-60-ORIG/qemu/slirp/ip.h kvm-60/qemu/slirp/ip.h
--- kvm-60-ORIG/qemu/slirp/ip.h 2008-01-20 05:35:04.000000000 -0700
+++ kvm-60/qemu/slirp/ip.h 2008-01-29 19:13:09.000000000 -0700
@@ -183,23 +183,9 @@
#define IP_MSS 576 /* default maximum segment size
*/
-#ifdef HAVE_SYS_TYPES32_H /* Overcome some Solaris 2.x junk */
-#include <sys/types32.h>
-#else
-#if SIZEOF_CHAR_P == 4
typedef caddr_t caddr32_t;
-#else
-typedef u_int32_t caddr32_t;
-#endif
-#endif
-
-#if SIZEOF_CHAR_P == 4
typedef struct ipq *ipqp_32;
typedef struct ipasfrag *ipasfragp_32;
-#else
-typedef caddr32_t ipqp_32;
-typedef caddr32_t ipasfragp_32;
-#endif
/*
* Overlay for ip header used by other protocols (tcp, udp).
diff -Naur kvm-60-ORIG/qemu/slirp/misc.c kvm-60/qemu/slirp/misc.c
--- kvm-60-ORIG/qemu/slirp/misc.c 2008-01-20 05:35:04.000000000 -0700
+++ kvm-60/qemu/slirp/misc.c 2008-01-29 11:36:15.000000000 -0700
@@ -97,39 +97,6 @@
our_addr.s_addr = loopback_addr.s_addr;
}
-#if SIZEOF_CHAR_P == 8
-
-struct quehead_32 {
- u_int32_t qh_link;
- u_int32_t qh_rlink;
-};
-
-inline void
-insque_32(a, b)
- void *a;
- void *b;
-{
- register struct quehead_32 *element = (struct quehead_32 *) a;
- register struct quehead_32 *head = (struct quehead_32 *) b;
- element->qh_link = head->qh_link;
- head->qh_link = (u_int32_t)element;
- element->qh_rlink = (u_int32_t)head;
- ((struct quehead_32 *)(element->qh_link))->qh_rlink
- = (u_int32_t)element;
-}
-
-inline void
-remque_32(a)
- void *a;
-{
- register struct quehead_32 *element = (struct quehead_32 *) a;
- ((struct quehead_32 *)(element->qh_link))->qh_rlink = element->qh_rlink;
- ((struct quehead_32 *)(element->qh_rlink))->qh_link = element->qh_link;
- element->qh_rlink = 0;
-}
-
-#endif /* SIZEOF_CHAR_P == 8 */
-
struct quehead {
struct quehead *qh_link;
struct quehead *qh_rlink;
diff -Naur kvm-60-ORIG/qemu/slirp/slirp.h kvm-60/qemu/slirp/slirp.h
--- kvm-60-ORIG/qemu/slirp/slirp.h 2008-01-20 05:35:04.000000000 -0700
+++ kvm-60/qemu/slirp/slirp.h 2008-01-29 11:37:19.000000000 -0700
@@ -265,13 +265,8 @@
void lprint _P((const char *, ...));
-#if SIZEOF_CHAR_P == 4
-# define insque_32 insque
-# define remque_32 remque
-#else
- inline void insque_32 _P((void *, void *));
- inline void remque_32 _P((void *));
-#endif
+#define insque_32 insque
+#define remque_32 remque
#ifndef _WIN32
#include <netdb.h>
diff -Naur kvm-60-ORIG/qemu/slirp/tcp_var.h kvm-60/qemu/slirp/tcp_var.h
--- kvm-60-ORIG/qemu/slirp/tcp_var.h 2008-01-20 05:35:04.000000000 -0700
+++ kvm-60/qemu/slirp/tcp_var.h 2008-01-28 21:12:22.000000000 -0700
@@ -40,11 +40,7 @@
#include "tcpip.h"
#include "tcp_timer.h"
-#if SIZEOF_CHAR_P == 4
- typedef struct tcpiphdr *tcpiphdrp_32;
-#else
- typedef u_int32_t tcpiphdrp_32;
-#endif
+typedef struct tcpiphdr *tcpiphdrp_32;
/*
* Tcp control block, one per tcp; fields:
@@ -178,11 +174,7 @@
* port numbers (which are no longer needed once we've located the
* tcpcb) are overlayed with an mbuf pointer.
*/
-#if SIZEOF_CHAR_P == 4
typedef struct mbuf *mbufp_32;
-#else
-typedef u_int32_t mbufp_32;
-#endif
#define REASS_MBUF(ti) (*(mbufp_32 *)&((ti)->ti_t))
#ifdef LOG_ENABLED
=================== END tcp_int32_pointer_cast.patch ===================
