[Spice-devel] [PATCH 2/3] Protect release_ring with malloc_sem

[alexl at redhat.com]

From: Alexander Larsson <alexl at redhat.com>

We need to protect the release ring against concurrent access, so
we need a semaphore for it. Since we already hold the malloc_sem in
almost all cases we access the ring we just extend its use to cover
all the places its used.
---
 display/qxldd.h |    2 +-
 display/res.c   |    5 +++++
 2 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/display/qxldd.h b/display/qxldd.h
index 82886a9..b225c3d 100644
--- a/display/qxldd.h
+++ b/display/qxldd.h
@@ -180,7 +180,7 @@ struct SurfaceInfo {
 
 typedef struct DevRes {   
     MspaceInfo mspaces[NUM_MSPACES];
-    HSEMAPHORE malloc_sem;
+    HSEMAPHORE malloc_sem; /* Also protects release ring */
 
     BOOL need_init;
     UINT64 free_outputs;
diff --git a/display/res.c b/display/res.c
index 71b6f80..9c60782 100644
--- a/display/res.c
+++ b/display/res.c
@@ -238,6 +238,7 @@ static void QXLSleep(PDev* pdev, int msec)
     DEBUG_PRINT((pdev, 19, "%s: 0x%lx exit\n", __FUNCTION__, pdev));
 }
 
+/* Called with malloc_sem held */
 static void WaitForReleaseRing(PDev* pdev)
 {
     int wait;
@@ -283,6 +284,7 @@ static void WaitForReleaseRing(PDev* pdev)
     DEBUG_PRINT((pdev, 16, "%s: 0x%lx, done\n", __FUNCTION__, pdev));
 }
 
+/* Called with malloc_sem held */
 static void FlushReleaseRing(PDev *pdev)
 {
     UINT64 output;
@@ -1354,11 +1356,14 @@ static CacheImage *AllocCacheImage(PDev* pdev)
 {
     RingItem *item;
     while (!(item = RingGetTail(pdev, &pdev->Res.dynamic->cache_image_lru))) {
+	/* malloc_sem protects release_ring too */
+        EngAcquireSemaphore(pdev->Res.malloc_sem);
         if (pdev->Res.free_outputs == 0 &&
             SPICE_RING_IS_EMPTY(pdev->release_ring)) {
             WaitForReleaseRing(pdev);
         }
         FlushReleaseRing(pdev);
+	EngReleaseSemaphore(pdev->Res.malloc_sem);
     }
     RingRemove(pdev, item);
     return CONTAINEROF(item, CacheImage, lru_link);
-- 
1.7.0.1