From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:55335) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGn7C-00073r-Vh for qemu-devel@nongnu.org; Wed, 06 Jan 2016 07:22:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aGn78-0004IO-0T for qemu-devel@nongnu.org; Wed, 06 Jan 2016 07:22:58 -0500 Received: from smtp02.citrix.com ([66.165.176.63]:41950) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aGn77-0004I0-SY for qemu-devel@nongnu.org; Wed, 06 Jan 2016 07:22:53 -0500 Message-ID: <568D071A.7050009@citrix.com> Date: Wed, 6 Jan 2016 12:22:50 +0000 From: David Vrabel MIME-Version: 1.0 References: In-Reply-To: Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [Xen-devel] [PATCH] xenfb.c: avoid expensive loops when prod <= out_cons List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefano Stabellini , qemu-devel@nongnu.org Cc: xen-devel@lists.xensource.com, liuling-it@360.cn On 06/01/16 12:08, Stefano Stabellini wrote: > If the frontend sets out_cons to a value higher than out_prod, it will > cause xenfb_handle_events to loop about 2^32 times. Avoid that by using > better checks at the beginning of the function. You can't use less than to compare prod and cons because they wrap. You need to compare (prod - cons) against ring size (or similar) to check for overflow. See RING_REQUEST_PROD_OVERFLOW() etc. David