From c8fa37e075cf59e8b21af9211f6a6348c92ed098 Mon Sep 17 00:00:00 2001
From: Alon Levy <alevy@redhat.com>
Date: Mon, 12 Jul 2010 22:48:59 +0300
Subject: [PATCH 25/39] spice-vmc: two bugfixes in vmc_read

 * throttling with no discard means possible recursion, make
  vmc_read handle that.
 * zero datapos when data is done (from rhel6 version)
---
 hw/spice-vmc.c |   13 ++++++++-----
 1 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/hw/spice-vmc.c b/hw/spice-vmc.c
index 3f6a2bb..06e30e6 100644
--- a/hw/spice-vmc.c
+++ b/hw/spice-vmc.c
@@ -45,7 +45,7 @@ static int vmc_write(SpiceVDIPortInstance *sin, const uint8_t *buf, int len)
     ssize_t out;

     out = virtio_serial_write(&svc->port, buf, len);
-    dprintf(svc, 2, "%s: %lu/%d\n", __func__, out, len);
+    dprintf(svc, 3, "%s: %lu/%d\n", __func__, out, len);
     return out;
 }

@@ -54,13 +54,16 @@ static int vmc_read(SpiceVDIPortInstance *sin, uint8_t *buf, int len)
     SpiceVirtualChannel *svc = container_of(sin, SpiceVirtualChannel, sin);
     int bytes = MIN(len, svc->datalen);

-    dprintf(svc, 2, "%s: %d/%zd\n", __func__, bytes, svc->datalen);
-    if (bytes) {
+    dprintf(svc, 2, "%s: %p %d/%d/%zd\n", __func__, svc->datapos, len, bytes, svc->datalen);
+    if (bytes > 0) {
         memcpy(buf, svc->datapos, bytes);
         svc->datapos += bytes;
         svc->datalen -= bytes;
-        if (0 == svc->datalen) {
+        assert(svc->datalen >= 0);
+        if (svc->datalen == 0) {
+            svc->datapos = 0;
             virtio_serial_throttle_port(&svc->port, false);
+            // ^^^ !!! may call vmc_have_data, so don't touch svc after it!
         }
     }
     return bytes;
@@ -140,7 +143,7 @@ static void vmc_have_data(VirtIOSerialPort *port, const uint8_t *buf, size_t len
     SpiceVirtualChannel *svc = DO_UPCAST(SpiceVirtualChannel, port, port);

     dprintf(svc, 2, "%s: %zd\n", __func__, len);
-    assert(svc->datapos == 0);
+    assert(svc->datalen == 0);
     if (svc->bufsize < len) {
         svc->bufsize = len;
         svc->buffer = qemu_realloc(svc->buffer, svc->bufsize);
-- 
1.7.2.3