[Spice-devel] [PATCH 08/17] Add protection for cursor_ring

[alexl at redhat.com]

From: Alexander Larsson <alexl at redhat.com>

---
 display/qxldd.h |    1 +
 display/res.c   |   11 +++++++++++
 2 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/display/qxldd.h b/display/qxldd.h
index 8c5516d..f09814f 100644
--- a/display/qxldd.h
+++ b/display/qxldd.h
@@ -181,6 +181,7 @@ typedef struct DevRes {
 
     HSEMAPHORE print_sem;
     HSEMAPHORE cmd_sem;
+    HSEMAPHORE cursor_sem; /* Protects cursor_ring */
     HSEMAPHORE surface_sem; /* Protects surfaces allocation */
 
     CacheImage cache_image_pool[IMAGE_POOL_SIZE];
diff --git a/display/res.c b/display/res.c
index 9f8c288..ceba034 100644
--- a/display/res.c
+++ b/display/res.c
@@ -154,6 +154,7 @@ static _inline void CursorCmdAddRes(PDev *pdev, QXLCursorCmd *cmd, Resource *res
     AddRes(pdev, output, res);
 }
 
+/* Called with cursor_sem held */
 static void WaitForCursorRing(PDev* pdev)
 {
     int wait;
@@ -390,6 +391,10 @@ void CleanGlobalRes()
                     EngDeleteSemaphore(res->cmd_sem);
                     res->cmd_sem = NULL;
                 }
+                if (res->cursor_sem) {
+                    EngDeleteSemaphore(res->cursor_sem);
+                    res->cursor_sem = NULL;
+                }
                 if (res->print_sem) {
                     EngDeleteSemaphore(res->print_sem);
                     res->print_sem = NULL;
@@ -455,6 +460,10 @@ static void InitRes(PDev *pdev)
     if (!pdev->Res->cmd_sem) {
         PANIC(pdev, "Res cmd sem creation failed\n");
     }
+    pdev->Res->cursor_sem = EngCreateSemaphore();
+    if (!pdev->Res->cursor_sem) {
+        PANIC(pdev, "Res cursor sem creation failed\n");
+    }
     pdev->Res->print_sem = EngCreateSemaphore();
     if (!pdev->Res->print_sem) {
         PANIC(pdev, "Res print sem creation failed\n");
@@ -2691,11 +2700,13 @@ void PushCursorCmd(PDev *pdev, QXLCursorCmd *cursor_cmd)
     QXLCommand *cmd;
 
     DEBUG_PRINT((pdev, 6, "%s\n", __FUNCTION__));
+    EngAcquireSemaphore(pdev->Res->cursor_sem);
     WaitForCursorRing(pdev);
     cmd = SPICE_RING_PROD_ITEM(pdev->cursor_ring);
     cmd->type = QXL_CMD_CURSOR;
     cmd->data = PA(pdev, cursor_cmd, pdev->main_mem_slot);
     PUSH_CURSOR_CMD(pdev);
+    EngReleaseSemaphore(pdev->Res->cursor_sem);
     DEBUG_PRINT((pdev, 8, "%s: done\n", __FUNCTION__));
 }
 
-- 
1.7.2.2