View difference between Paste ID: NNy6LreF and CzGEiPUQ

 /*
  * qemu slirp test case - based on slirp/if.c from qemu commit a9158a5cba955b7
  * This shows how slirp->next_m can get set to an incorrect value, stalling a socket (session).
  *
  * Usage:
  *   gcc slirp_test.c -o slirp_test -Wall && ./slirp_test
  */
 
 #include <stdbool.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 struct quehead {
     struct quehead *qh_link;
     struct quehead *qh_rlink;
 };
 
 struct Slirp {
     struct quehead if_fastq;   /* fast queue (for interactive data) */
     struct quehead if_batchq;  /* queue for non-interactive data */
     struct mbuf *next_m;    /* pointer to next mbuf to output */
     bool if_start_busy;     /* avoid if_start recursion */
 };
 
 typedef struct Slirp Slirp;
 
 struct socket {
 	int so_queued;
 	int so_nqueued;
 	int so_iptos;
 };
 
 #define IPTOS_LOWDELAY 1
 
 struct mbuf {
 	struct	mbuf *m_next;		/* Linked list of mbufs */
 	struct	mbuf *m_prev;
 	struct	mbuf *m_nextpkt;	/* Next packet in queue/record */
 	struct	mbuf *m_prevpkt;	/* Flags aren't used in the output queue */
 	struct	socket *m_so;
 	Slirp *slirp;
 	uint64_t expiration_date;
 	int encap_result;
 };
 
 #define QEMU_CLOCK_REALTIME 1
 static uint64_t qemu_clock_get_ns(int x)
 {
 	return 0;
 }
 
 static int if_encap(Slirp *slirp, struct mbuf *ifm)
 {
 	printf("if_encap(%p) returning %d\n", ifm, ifm->encap_result);
 	return ifm->encap_result;
 }
 
 static void m_free(void *foo)
 {
 }
 
 #define ifq_prev m_prev
 #define ifq_next m_next
 #define ifs_prev m_prevpkt
 #define ifs_next m_nextpkt
 #define ifq_so m_so
 
 inline void
 insque(void *a, void *b)
 {
 	register struct quehead *element = (struct quehead *) a;
 	register struct quehead *head = (struct quehead *) b;
 	element->qh_link = head->qh_link;
 	head->qh_link = (struct quehead *)element;
 	element->qh_rlink = (struct quehead *)head;
 	((struct quehead *)(element->qh_link))->qh_rlink
 	= (struct quehead *)element;
 }
 
 inline void
 remque(void *a)
 {
   register struct quehead *element = (struct quehead *) a;
   ((struct quehead *)(element->qh_link))->qh_rlink = element->qh_rlink;
   ((struct quehead *)(element->qh_rlink))->qh_link = element->qh_link;
   element->qh_rlink = NULL;
 }
 
 static void
 ifs_insque(struct mbuf *ifm, struct mbuf *ifmhead)
 {
 	ifm->ifs_next = ifmhead->ifs_next;
 	ifmhead->ifs_next = ifm;
 	ifm->ifs_prev = ifmhead;
 	ifm->ifs_next->ifs_prev = ifm;
 }
 
 static inline void ifs_init(struct mbuf *ifm)
 {
     ifm->ifs_next = ifm->ifs_prev = ifm;
 }
 
 static void
 ifs_remque(struct mbuf *ifm)
 {
 	ifm->ifs_prev->ifs_next = ifm->ifs_next;
 	ifm->ifs_next->ifs_prev = ifm->ifs_prev;
 }
 
 void
 if_init(Slirp *slirp)
 {
     slirp->if_fastq.qh_link = slirp->if_fastq.qh_rlink = &slirp->if_fastq;
     slirp->if_batchq.qh_link = slirp->if_batchq.qh_rlink = &slirp->if_batchq;
     slirp->next_m = (struct mbuf *) &slirp->if_batchq;
 }
 
 void if_start(Slirp *slirp);
 
 /*
  * if_output: Queue packet into an output queue.
  * There are 2 output queue's, if_fastq and if_batchq.
  * Each output queue is a doubly linked list of double linked lists
  * of mbufs, each list belonging to one "session" (socket).  This
  * way, we can output packets fairly by sending one packet from each
  * session, instead of all the packets from one session, then all packets
  * from the next session, etc.  Packets on the if_fastq get absolute
  * priority, but if one session hogs the link, it gets "downgraded"
  * to the batchq until it runs out of packets, then it'll return
  * to the fastq (eg. if the user does an ls -alR in a telnet session,
  * it'll temporarily get downgraded to the batchq)
  */
 void
 if_output(struct socket *so, struct mbuf *ifm)
 {
 	Slirp *slirp = ifm->slirp;
 	struct mbuf *ifq;
 	int on_fastq = 1;
 
 	/*
 	 * See if there's already a batchq list for this session.
 	 * This can include an interactive session, which should go on fastq,
 	 * but gets too greedy... hence it'll be downgraded from fastq to batchq.
 	 * We mustn't put this packet back on the fastq (or we'll send it out of order)
 	 * XXX add cache here?
 	 */
 	for (ifq = (struct mbuf *) slirp->if_batchq.qh_rlink;
 	     (struct quehead *) ifq != &slirp->if_batchq;
 	     ifq = ifq->ifq_prev) {
 		if (so == ifq->ifq_so) {
 			/* A match! */
 			ifm->ifq_so = so;
 			ifs_insque(ifm, ifq->ifs_prev);
 			goto diddit;
 		}
 	}
 
 	/* No match, check which queue to put it on */
 	if (so && (so->so_iptos & IPTOS_LOWDELAY)) {
 		ifq = (struct mbuf *) slirp->if_fastq.qh_rlink;
 		on_fastq = 1;
 		/*
 		 * Check if this packet is a part of the last
 		 * packet's session
 		 */
 		if (ifq->ifq_so == so) {
 			ifm->ifq_so = so;
 			ifs_insque(ifm, ifq->ifs_prev);
 			goto diddit;
 		}
         } else {
 		ifq = (struct mbuf *) slirp->if_batchq.qh_rlink;
                 /* Set next_m if the queue was empty so far */
                 if ((struct quehead *) slirp->next_m == &slirp->if_batchq) {
                     slirp->next_m = ifm;
                 }
         }
 
 	/* Create a new doubly linked list for this session */
 	ifm->ifq_so = so;
 	ifs_init(ifm);
 	insque(ifm, ifq);
 
 diddit:
 	if (so) {
 		/* Update *_queued */
 		so->so_queued++;
 		so->so_nqueued++;
 		/*
 		 * Check if the interactive session should be downgraded to
 		 * the batchq.  A session is downgraded if it has queued 6
 		 * packets without pausing, and at least 3 of those packets
 		 * have been sent over the link
 		 * (XXX These are arbitrary numbers, probably not optimal..)
 		 */
 		if (on_fastq && ((so->so_nqueued >= 6) &&
 				 (so->so_nqueued - so->so_queued) >= 3)) {
 
 			/* Remove from current queue... */
 			remque(ifm->ifs_next);
 
 			/* ...And insert in the new.  That'll teach ya! */
 			insque(ifm->ifs_next, &slirp->if_batchq);
 		}
 	}
 
 #ifndef FULL_BOLT
 	/*
 	 * This prevents us from malloc()ing too many mbufs
 	 */
 	if_start(ifm->slirp);
 #endif
 }
 
 /*
  * Send a packet
  * We choose a packet based on its position in the output queues;
  * If there are packets on the fastq, they are sent FIFO, before
  * everything else.  Otherwise we choose the first packet from the
  * batchq and send it.  the next packet chosen will be from the session
  * after this one, then the session after that one, and so on..  So,
  * for example, if there are 3 ftp session's fighting for bandwidth,
  * one packet will be sent from the first session, then one packet
  * from the second session, then one packet from the third, then back
  * to the first, etc. etc.
  */
 void if_start(Slirp *slirp)
 {
     uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
     bool from_batchq, next_from_batchq;
     struct mbuf *ifm, *ifm_next, *ifqt;
 
     if (slirp->if_start_busy) {
         return;
     }
     slirp->if_start_busy = true;
 
     if (slirp->if_fastq.qh_link != &slirp->if_fastq) {
         ifm_next = (struct mbuf *) slirp->if_fastq.qh_link;
         next_from_batchq = false;
     } else if ((struct quehead *) slirp->next_m != &slirp->if_batchq) {
         /* Nothing on fastq, pick up from batchq via next_m */
         ifm_next = slirp->next_m;
         next_from_batchq = true;
     } else {
         ifm_next = NULL;
     }
 
     printf("\nif_start loop begins\n");
     while (ifm_next) {
         ifm = ifm_next;
         printf("ifm_next=%p (session=%p), slirp->next_m=%p\n",
 		ifm, ifm->m_so, slirp->next_m);
         from_batchq = next_from_batchq;
 
         ifm_next = ifm->ifq_next;
         if ((struct quehead *) ifm_next == &slirp->if_fastq) {
             /* No more packets in fastq, switch to batchq */
             ifm_next = slirp->next_m;
             next_from_batchq = true;
         }
         if ((struct quehead *) ifm_next == &slirp->if_batchq) {
             /* end of batchq */
             ifm_next = NULL;
         }
 
         /* Try to send packet unless it already expired */
         if (ifm->expiration_date >= now && !if_encap(slirp, ifm)) {
             /* Packet is delayed due to pending ARP or NDP resolution */
             continue;
         }
 
         if (ifm == slirp->next_m) {
             /* Set which packet to send on next iteration */
             slirp->next_m = ifm->ifq_next;
         }
 
         /* Remove it from the queue */
         ifqt = ifm->ifq_prev;
         remque(ifm);
 
         /* If there are more packets for this session, re-queue them */
         if (ifm->ifs_next != ifm) {
             struct mbuf *next = ifm->ifs_next;
 
             insque(next, ifqt);
             ifs_remque(ifm);
 
             if (!from_batchq) {
                 /* Next packet in fastq is from the same session */
                 ifm_next = next;
                 next_from_batchq = false;
             } else if ((struct quehead *) slirp->next_m == &slirp->if_batchq) {
                 /* Set next_m and ifm_next if the session packet is now the
                  * only one on batchq */
                 slirp->next_m = ifm_next = next;
             }
         }
 
         /* Update so_queued */
         if (ifm->ifq_so && --ifm->ifq_so->so_queued == 0) {
             /* If there's no more queued, reset nqueued */
             ifm->ifq_so->so_nqueued = 0;
         }
 
         m_free(ifm);
     }
 
     slirp->if_start_busy = false;
 }
 
 int main(int argc, char **argv)
 {
 	Slirp s;
     memset(&s, 0, sizeof(s));
 	if_init(&s);
 
 	struct mbuf p0 = {0};
 	struct socket s0 = {0};
 	struct mbuf p1 = {0};
 	struct socket s1 = {0};
 	struct mbuf p2 = {0};
 	struct mbuf p3 = {0};
 
 	printf("s0                        = %p\n", &s0);
 	printf("s1                        = %p\n", &s1);
 	printf("\n");
 	printf("p0                        = %p\n", &p0);
 	printf("p1                        = %p\n", &p1);
 	printf("p2                        = %p\n", &p2);
 	printf("p3                        = %p\n", &p3);
 	printf("&slirp->if_batchq         = %p\n", &s.if_batchq);
 
 	p0.slirp = &s;
 	p0.encap_result = 0;
 	if_output(&s0, &p0);
 
 	p1.slirp = &s;
 	p1.encap_result = 0;
 	if_output(&s0, &p1);
 
 	p0.encap_result = 1;
 	p2.slirp = &s;
 	p2.encap_result = 1;
 	if_output(&s1, &p2);
 
 	p3.slirp = &s;
 	p3.encap_result = 1;
 	if_output(&s0, &p3);
 
 	printf("\nFinal results:\n");
 	printf("slirp->if_batchq.qh_link  = %p\n", s.if_batchq.qh_link);
 	printf("slirp->if_batchq.qh_rlink = %p\n", s.if_batchq.qh_rlink);
 	printf("slirp->next_m             = %p\n", s.next_m);
 
 	return 0;
 }