[PATCH] qxl: fix release ring overrun

[Gerd Hoffmann]

---
 hw/qxl.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/qxl.c b/hw/qxl.c
index a8ef869..c86d832 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -401,10 +401,10 @@ static inline void qxl_push_free_res(PCIQXLDevice *d)
     QXLReleaseRing *ring = &d->ram->release_ring;
     uint64_t *item;
 
-#define QXL_FREE_BUNCH_SIZE 10
+#define QXL_FREE_BUNCH_SIZE 32
 
-    if (SPICE_RING_IS_EMPTY(ring) || (d->num_free_res == QXL_FREE_BUNCH_SIZE &&
-                                      ring->prod - ring->cons + 1 != ring->num_items)) {
+    if (SPICE_RING_IS_EMPTY(ring) || (d->num_free_res >= QXL_FREE_BUNCH_SIZE &&
+                                      ring->prod - ring->cons + 2 != ring->num_items)) {
         int notify;
 
         SPICE_RING_PUSH(ring, notify);
-- 
1.7.1


--------------060300060601000407050106--