Bug 1135372

Summary: Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump
Product: Red Hat Enterprise Linux 6 Reporter: Gerd Hoffmann <kraxel>
Component: spice-serverAssignee: Christophe Fergeau <cfergeau>
Status: CLOSED ERRATA QA Contact: SPICE QE bug list <spice-qe-bugs>
Severity: high Docs Contact:
Priority: high    
Version: 6.6CC: cfergeau, dblechte, djasa, huding, juzhang, marcandre.lureau, mazhang, michen, mkenneth, qzhang, rbalakri, rpacheco, shu, tpelka, virt-bugs, virt-maint, xfu
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Fixed In Version: spice-server-0.12.4-12.el6 Doc Type: Bug Fix
Doc Text:
* Prior to this update, when using the "rhel6.0.0" Quick Emulator (QEMU) machine type, the guest could receive invalid drawing commands. Consequently, spice-server terminated unexpectedly. With this update, spice-server detects these invalid drawing commands and ignores them. As a result, spice-server no longer crashes when using the "rhel6.0.0" QEMU machine type. (BZ#1135372)
Story Points: ---
Clone Of: 1095612 Environment:
Last Closed: 2015-07-22 07:28:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On:    
Bug Blocks: 1052856    

Comment 1 Gerd Hoffmann 2014-08-29 07:37:06 UTC
See last comment from original bug.  spice-server should never pass us negative values.

Comment 3 Marc-Andre Lureau 2014-09-05 00:30:00 UTC
The origin of the invilid drawing is 

#0  make_drawable (compat_qxl=0x1332840, type=1 '\001', rect=0x7fff86e33d30)
    at compat-qxl_driver.c:393
#1  0x00007f7a6e9928cf in submit_fill (compat_qxl=0x1332840, 
    rect=0x7fff86e33d30, color=0) at compat-qxl_driver.c:449
#2  0x00007f7a6e993146 in compat_qxl_poly_fill_rect (pDrawable=0x19a04d0, 
    pGC=0x1383de0, nrect=1, prect=0x1a37010) at compat-qxl_driver.c:735
#3  0x000000000052c57d in damagePolyFillRect (pDrawable=0x19a04d0, 
    pGC=0x1383de0, nRects=1, pRects=<value optimized out>) at damage.c:1194
#4  0x000000000058b22a in miPaintWindow (pWin=<value optimized out>, 
    prgn=<value optimized out>, what=<value optimized out>) at miexpose.c:641
#5  0x000000000058b778 in miWindowExposures (pWin=0x19a04d0, prgn=0x23e3b30, 
    other_exposed=0x0) at miexpose.c:470
#6  0x00000000005a3948 in miHandleValidateExposures (pWin=0x1a371b0)
    at miwindow.c:223
#7  0x000000000046679f in MapWindow (pWin=0x19a04d0, client=0x19fd3c0)
    at window.c:2582

(gdb) print *pBox
$5 = {x1 = 941, y1 = -19, x2 = 945, y2 = 5}

(note that the int is copied in a uint32 of compat_qxl_rect and then copied back to an int in qemu...)

The new revision driver doesn't reach this condition in the PolyFillRect implementation, probably because of real or "fake" offscreen surface implementation.

It seems remving the qxl code in compat_qxl_poly_fill_rect() doesn't change the drawing result or create artefacts (even with bare X applications, such as xclock). I would propose that fix for xorg-qxl driver.

However, we need to add more checks in server the server to prevent guest from crashing host qemu.

Comment 4 Marc-Andre Lureau 2014-09-05 21:11:32 UTC
xorg qxl driver build provided for rebase #1078390 shouldn't reach that issue. The server remains to be made more robust by adding checks of drawable->bbox against the surface it is operating with.

Comment 11 errata-xmlrpc 2015-07-22 07:28:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.