diff mbox series

[2/2] qxl: Fix race on accessing cursor in struct SimpleSpiceDisplay

Message ID 6119a51b8626575d1f5e6ac31630f88afa32eba9.1734633496.git.yong.huang@smartx.com (mailing list archive)
State New
Headers show
Series [1/2] qxl: Do not use C99 // comments | expand

Commit Message

Hyman Huang Dec. 19, 2024, 6:46 p.m. UTC
Both the spice server and the qemu (iothread/main loop) context
can access the cursor field in struct SimpleSpiceDisplay.

Add the mutex lock before accessing cursor in
qxl_spice_reset_cursor().

Signed-off-by: Hyman Huang <yong.huang@smartx.com>
---
 hw/display/qxl.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Philippe Mathieu-Daudé Dec. 20, 2024, 10:41 a.m. UTC | #1
Hi Hyman,

On 19/12/24 19:46, Hyman Huang wrote:
> Both the spice server and the qemu (iothread/main loop) context
> can access the cursor field in struct SimpleSpiceDisplay.
> 
> Add the mutex lock before accessing cursor in
> qxl_spice_reset_cursor().
> 
> Signed-off-by: Hyman Huang <yong.huang@smartx.com>
> ---
>   hw/display/qxl.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/hw/display/qxl.c b/hw/display/qxl.c
> index ae2d983299..d1fbeb65cf 100644
> --- a/hw/display/qxl.c
> +++ b/hw/display/qxl.c
> @@ -298,10 +298,12 @@ void qxl_spice_reset_cursor(PCIQXLDevice *qxl)
>       qemu_mutex_lock(&qxl->track_lock);
>       qxl->guest_cursor = 0;
>       qemu_mutex_unlock(&qxl->track_lock);
> +    qemu_mutex_lock(&qxl->ssd.lock);
>       if (qxl->ssd.cursor) {
>           cursor_unref(qxl->ssd.cursor);
>       }
>       qxl->ssd.cursor = cursor_builtin_hidden();
> +    qemu_mutex_unlock(&qxl->ssd.lock);
>   }

Alternatively convert to use WITH_QEMU_LOCK_GUARD() from
"qemu/lockable.h".

Regards,

Phil.
diff mbox series

Patch

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index ae2d983299..d1fbeb65cf 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -298,10 +298,12 @@  void qxl_spice_reset_cursor(PCIQXLDevice *qxl)
     qemu_mutex_lock(&qxl->track_lock);
     qxl->guest_cursor = 0;
     qemu_mutex_unlock(&qxl->track_lock);
+    qemu_mutex_lock(&qxl->ssd.lock);
     if (qxl->ssd.cursor) {
         cursor_unref(qxl->ssd.cursor);
     }
     qxl->ssd.cursor = cursor_builtin_hidden();
+    qemu_mutex_unlock(&qxl->ssd.lock);
 }
 
 static uint32_t qxl_crc32(const uint8_t *p, unsigned len)