From: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
To: peter.maydell@linaro.org
Cc: xen-devel@lists.xensource.com, qemu-devel@nongnu.org,
Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Subject: [PULL 02/11] xenfb.c: avoid expensive loops when prod <= out_cons
Date: Thu, 21 Jan 2016 17:01:21 +0000 [thread overview]
Message-ID: <1453395690-32660-2-git-send-email-stefano.stabellini@eu.citrix.com> (raw)
In-Reply-To: <alpine.DEB.2.02.1601211649260.13552@kaball.uk.xensource.com>
If the frontend sets out_cons to a value higher than out_prod, it will
cause xenfb_handle_events to loop about 2^32 times. Avoid that by using
better checks at the beginning of the function.
Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Reported-by: Ling Liu <liuling-it@360.cn>
---
hw/display/xenfb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 4e2a27a..8eb3046 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -789,8 +789,9 @@ static void xenfb_handle_events(struct XenFB *xenfb)
prod = page->out_prod;
out_cons = page->out_cons;
- if (prod == out_cons)
- return;
+ if (prod - out_cons >= XENFB_OUT_RING_LEN) {
+ return;
+ }
xen_rmb(); /* ensure we see ring contents up to prod */
for (cons = out_cons; cons != prod; cons++) {
union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
--
1.7.10.4
next prev parent reply other threads:[~2016-01-21 17:01 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-21 17:01 [PULL 0/11] xen-20160121 Stefano Stabellini
2016-01-21 17:01 ` [PULL 01/11] MAINTAINERS: update Xen files Stefano Stabellini
2016-01-21 17:01 ` Stefano Stabellini [this message]
2016-01-21 17:01 ` [PULL 03/11] xen-hvm: Clean up xen_hvm_init() error handling Stefano Stabellini
2016-01-21 17:01 ` [PULL 04/11] xen-hvm: Clean up xen_ram_alloc() " Stefano Stabellini
2016-01-21 17:01 ` [PULL 05/11] xen-pvdevice: convert to realize() Stefano Stabellini
2016-01-21 17:01 ` [PULL 06/11] Change xen_host_pci_sysfs_path() to return void Stefano Stabellini
2016-01-21 17:01 ` [PULL 07/11] Xen: use qemu_strtoul instead of strtol Stefano Stabellini
2016-01-21 17:01 ` [PULL 08/11] Add Error **errp for xen_host_pci_device_get() Stefano Stabellini
2016-01-21 17:01 ` [PULL 09/11] Add Error **errp for xen_pt_setup_vga() Stefano Stabellini
2016-01-21 17:01 ` [PULL 10/11] Add Error **errp for xen_pt_config_init() Stefano Stabellini
2016-01-22 11:21 ` Paolo Bonzini
2016-01-23 12:23 ` Cao jin
2016-01-25 10:53 ` Stefano Stabellini
2016-01-21 17:01 ` [PULL 11/11] Xen PCI passthru: convert to realize() Stefano Stabellini
2016-01-21 17:45 ` [PULL 0/11] xen-20160121 Peter Maydell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1453395690-32660-2-git-send-email-stefano.stabellini@eu.citrix.com \
--to=stefano.stabellini@eu.citrix.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=xen-devel@lists.xensource.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).