[Xen-changelog] [qemu-xen stable-4.6] xenfb.c: avoid expensive loops when prod <= out_cons

[patchbot@xxxxxxx]

commit 5177ee26e9f11a4e074e64567cfd1778bdbd2997
Author:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
AuthorDate: Wed Jan 6 16:32:22 2016 +0000
Commit:     Anthony PERARD <anthony.perard@xxxxxxxxxx>
CommitDate: Mon Apr 25 11:12:57 2016 +0100

    xenfb.c: avoid expensive loops when prod <= out_cons
    
    If the frontend sets out_cons to a value higher than out_prod, it will
    cause xenfb_handle_events to loop about 2^32 times. Avoid that by using
    better checks at the beginning of the function.
    
    upstream-commit-id: ac0487e1d2ae811cd4d035741a109a4ecfb013f1
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
    Reported-by: Ling Liu <liuling-it@xxxxxx>
---
 hw/display/xenfb.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 7baacbe..56d1a36 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -784,8 +784,9 @@ static void xenfb_handle_events(struct XenFB *xenfb)
 
     prod = page->out_prod;
     out_cons = page->out_cons;
-    if (prod == out_cons)
-       return;
+    if (prod - out_cons >= XENFB_OUT_RING_LEN) {
+        return;
+    }
     xen_rmb();         /* ensure we see ring contents up to prod */
     for (cons = out_cons; cons != prod; cons++) {
        union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog