izzy/xemu
0
0
Fork 0
mirror of https://github.com/izzy2lost/xemu.git synced 2026-07-06 00:20:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'remotes/sstabellini/tags/xsa155' into staging

Browse Source 
XSA-155 fixes

# gpg: Signature made Fri 18 Dec 2015 15:16:18 GMT using RSA key ID 70E1AE90
# gpg: Good signature from "Stefano Stabellini <stefano.stabellini@eu.citrix.com>"

* remotes/sstabellini/tags/xsa155:
  xenfb: avoid reading twice the same fields from the shared page
  xen/blkif: Avoid double access to src->nr_segments

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Peter Maydell
2015-12-18 15:32:32 +00:00
parent 18f49881cf 7ea11bf376
commit 6126bc5522
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hw/block/xen_blkif.h
+8 -4
View File
@@ -85,8 +85,10 @@ static inline void blkif_get_x86_32_req(blkif_request_t *dst, blkif_x86_32_reque
d->nr_sectors = s->nr_sectors;
return;
}
if (n > src->nr_segments)
n = src->nr_segments;
/* prevent the compiler from optimizing the code and using src->nr_segments instead */
barrier();
if (n > dst->nr_segments)
n = dst->nr_segments;
for (i = 0; i < n; i++)
dst->seg[i] = src->seg[i];
}
@@ -106,8 +108,10 @@ static inline void blkif_get_x86_64_req(blkif_request_t *dst, blkif_x86_64_reque
d->nr_sectors = s->nr_sectors;
return;
}
if (n > src->nr_segments)
n = src->nr_segments;
/* prevent the compiler from optimizing the code and using src->nr_segments instead */
barrier();
if (n > dst->nr_segments)
n = dst->nr_segments;
for (i = 0; i < n; i++)
dst->seg[i] = src->seg[i];
}
hw/display/xenfb.c
+6 -4
View File
@@ -784,18 +784,20 @@ static void xenfb_invalidate(void *opaque)
static void xenfb_handle_events(struct XenFB *xenfb)
{
uint32_t prod, cons;
uint32_t prod, cons, out_cons;
struct xenfb_page *page = xenfb->c.page;
prod = page->out_prod;
if (prod == page->out_cons)
out_cons = page->out_cons;
if (prod == out_cons)
return;
xen_rmb(); /* ensure we see ring contents up to prod */
for (cons = page->out_cons; cons != prod; cons++) {
for (cons = out_cons; cons != prod; cons++) {
union xenfb_out_event *event = &XENFB_OUT_RING_REF(page, cons);
uint8_t type = event->type;
int x, y, w, h;
switch (event->type) {
switch (type) {
case XENFB_TYPE_UPDATE:
if (xenfb->up_count == UP_QUEUE)
xenfb->up_fullscreen = 1;