The post_load handler reads the last queued pointer event at index
head+n, but in a circular queue with head as the first element and
n elements, the last valid entry is at head+n-1. When n equals
QUEUE_LENGTH (16), head+n wraps to head, reading the oldest entry
instead of the newest.
Fixes: ba4d26064e8c ("hid: handle full ptr queues in post_load")
Reported-by: Pavee Hui <[email protected]>
Signed-off-by: Marc-André Lureau <[email protected]>
---
hw/input/hid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/input/hid.c b/hw/input/hid.c
index 5098497f41bb..847eac97cbe8 100644
--- a/hw/input/hid.c
+++ b/hw/input/hid.c
@@ -567,7 +567,7 @@ static int hid_post_load(void *opaque, int version_id)
* mouse.
*/
HIDPointerEvent evt;
- evt = s->ptr.queue[(s->head+s->n) & QUEUE_MASK];
+ evt = s->ptr.queue[(s->head + s->n - 1) & QUEUE_MASK];
if (s->kind == HID_MOUSE) {
evt.xdx = 0;
evt.ydy = 0;
--
2.56.0.rc0.29.g47ce80527c56
