Bug 1135372
| Summary: | Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Gerd Hoffmann <kraxel> |
| Component: | spice-server | Assignee: | Christophe Fergeau <cfergeau> |
| Status: | CLOSED ERRATA | QA Contact: | SPICE QE bug list <spice-qe-bugs> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.6 | CC: | cfergeau, dblechte, djasa, huding, juzhang, marcandre.lureau, mazhang, michen, mkenneth, qzhang, rbalakri, rpacheco, shu, tpelka, virt-bugs, virt-maint, xfu |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | spice-server-0.12.4-12.el6 | Doc Type: | Bug Fix |
| Doc Text: |
* Prior to this update, when using the "rhel6.0.0" Quick Emulator (QEMU) machine type, the guest could receive invalid drawing commands. Consequently, spice-server terminated unexpectedly. With this update, spice-server detects these invalid drawing commands and ignores them. As a result, spice-server no longer crashes when using the "rhel6.0.0" QEMU machine type. (BZ#1135372)
|
Story Points: | --- |
| Clone Of: | 1095612 | Environment: | |
| Last Closed: | 2015-07-22 07:28:25 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1052856 | ||
|
Comment 1
Gerd Hoffmann
2014-08-29 07:37:06 UTC
The origin of the invilid drawing is
#0 make_drawable (compat_qxl=0x1332840, type=1 '\001', rect=0x7fff86e33d30)
at compat-qxl_driver.c:393
#1 0x00007f7a6e9928cf in submit_fill (compat_qxl=0x1332840,
rect=0x7fff86e33d30, color=0) at compat-qxl_driver.c:449
#2 0x00007f7a6e993146 in compat_qxl_poly_fill_rect (pDrawable=0x19a04d0,
pGC=0x1383de0, nrect=1, prect=0x1a37010) at compat-qxl_driver.c:735
#3 0x000000000052c57d in damagePolyFillRect (pDrawable=0x19a04d0,
pGC=0x1383de0, nRects=1, pRects=<value optimized out>) at damage.c:1194
#4 0x000000000058b22a in miPaintWindow (pWin=<value optimized out>,
prgn=<value optimized out>, what=<value optimized out>) at miexpose.c:641
#5 0x000000000058b778 in miWindowExposures (pWin=0x19a04d0, prgn=0x23e3b30,
other_exposed=0x0) at miexpose.c:470
#6 0x00000000005a3948 in miHandleValidateExposures (pWin=0x1a371b0)
at miwindow.c:223
#7 0x000000000046679f in MapWindow (pWin=0x19a04d0, client=0x19fd3c0)
at window.c:2582
(gdb) print *pBox
$5 = {x1 = 941, y1 = -19, x2 = 945, y2 = 5}
(note that the int is copied in a uint32 of compat_qxl_rect and then copied back to an int in qemu...)
The new revision driver doesn't reach this condition in the PolyFillRect implementation, probably because of real or "fake" offscreen surface implementation.
It seems remving the qxl code in compat_qxl_poly_fill_rect() doesn't change the drawing result or create artefacts (even with bare X applications, such as xclock). I would propose that fix for xorg-qxl driver.
However, we need to add more checks in server the server to prevent guest from crashing host qemu.
xorg qxl driver build provided for rebase #1078390 shouldn't reach that issue. The server remains to be made more robust by adding checks of drawable->bbox against the surface it is operating with. Upstream commit is http://cgit.freedesktop.org/spice/spice/commit/?id=e270edcbfd958d764e84cdbca6d403ff24fef610 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1394.html |