From 006bf4641b553565990a6b18e0cff36972a36773 Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Fri, 20 Jul 2018 08:31:09 +0200 Subject: [PATCH] spice-display: fix qemu_spice_cursor_refresh_bh locking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit spice-display should not call the ui/console.c functions dpy_cursor_define and dpy_moues_set with the SimpleSpiceDisplay lock taken. That will cause a deadlock, because the DisplayChangeListener callbacks will take the lock again. It is also in general a bad idea to invoke generic callbacks with a lock taken, because it can cause AB-BA deadlocks in the long run. The only thing that requires care is that the cursor may disappear as soon as the mutex is released, so you need an extra cursor_get/cursor_put pair. Signed-off-by: Paolo Bonzini Reviewed-by: Marc-André Lureau Message-id: 20180720063109.4631-3-pbonzini@redhat.com [ kraxel: fix dpy_cursor_define() call ] Signed-off-by: Gerd Hoffmann --- ui/spice-display.c | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/ui/spice-display.c b/ui/spice-display.c index 46df673cd7..7b230987dc 100644 --- a/ui/spice-display.c +++ b/ui/spice-display.c @@ -450,27 +450,33 @@ void qemu_spice_display_switch(SimpleSpiceDisplay *ssd, qemu_mutex_unlock(&ssd->lock); } -static void qemu_spice_cursor_refresh_unlocked(SimpleSpiceDisplay *ssd) -{ - if (ssd->cursor) { - assert(ssd->dcl.con); - dpy_cursor_define(ssd->dcl.con, ssd->cursor); - } - if (ssd->mouse_x != -1 && ssd->mouse_y != -1) { - assert(ssd->dcl.con); - dpy_mouse_set(ssd->dcl.con, ssd->mouse_x, ssd->mouse_y, 1); - ssd->mouse_x = -1; - ssd->mouse_y = -1; - } -} - void qemu_spice_cursor_refresh_bh(void *opaque) { SimpleSpiceDisplay *ssd = opaque; qemu_mutex_lock(&ssd->lock); - qemu_spice_cursor_refresh_unlocked(ssd); - qemu_mutex_unlock(&ssd->lock); + if (ssd->cursor) { + QEMUCursor *c = ssd->cursor; + assert(ssd->dcl.con); + cursor_get(c); + qemu_mutex_unlock(&ssd->lock); + dpy_cursor_define(ssd->dcl.con, c); + qemu_mutex_lock(&ssd->lock); + cursor_put(c); + } + + if (ssd->mouse_x != -1 && ssd->mouse_y != -1) { + int x, y; + assert(ssd->dcl.con); + x = ssd->mouse_x; + y = ssd->mouse_y; + ssd->mouse_x = -1; + ssd->mouse_y = -1; + qemu_mutex_unlock(&ssd->lock); + dpy_mouse_set(ssd->dcl.con, x, y, 1); + } else { + qemu_mutex_unlock(&ssd->lock); + } } void qemu_spice_display_refresh(SimpleSpiceDisplay *ssd)