Bug 1135372 - Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump
Summary: Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: spice-server
Version: 6.6
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Christophe Fergeau
QA Contact: SPICE QE bug list
URL:
Whiteboard:
Depends On:
Blocks: 1052856
TreeView+ depends on / blocked
 
Reported: 2014-08-29 07:35 UTC by Gerd Hoffmann
Modified: 2015-07-22 07:28 UTC (History)
17 users (show)

Fixed In Version: spice-server-0.12.4-12.el6
Doc Type: Bug Fix
Doc Text:
* Prior to this update, when using the "rhel6.0.0" Quick Emulator (QEMU) machine type, the guest could receive invalid drawing commands. Consequently, spice-server terminated unexpectedly. With this update, spice-server detects these invalid drawing commands and ignores them. As a result, spice-server no longer crashes when using the "rhel6.0.0" QEMU machine type. (BZ#1135372)
Clone Of: 1095612
Environment:
Last Closed: 2015-07-22 07:28:25 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1394 normal SHIPPED_LIVE spice-server bug fix update 2015-07-20 17:58:02 UTC

Comment 1 Gerd Hoffmann 2014-08-29 07:37:06 UTC
See last comment from original bug.  spice-server should never pass us negative values.

Comment 3 Marc-Andre Lureau 2014-09-05 00:30:00 UTC
The origin of the invilid drawing is 

#0  make_drawable (compat_qxl=0x1332840, type=1 '\001', rect=0x7fff86e33d30)
    at compat-qxl_driver.c:393
#1  0x00007f7a6e9928cf in submit_fill (compat_qxl=0x1332840, 
    rect=0x7fff86e33d30, color=0) at compat-qxl_driver.c:449
#2  0x00007f7a6e993146 in compat_qxl_poly_fill_rect (pDrawable=0x19a04d0, 
    pGC=0x1383de0, nrect=1, prect=0x1a37010) at compat-qxl_driver.c:735
#3  0x000000000052c57d in damagePolyFillRect (pDrawable=0x19a04d0, 
    pGC=0x1383de0, nRects=1, pRects=<value optimized out>) at damage.c:1194
#4  0x000000000058b22a in miPaintWindow (pWin=<value optimized out>, 
    prgn=<value optimized out>, what=<value optimized out>) at miexpose.c:641
#5  0x000000000058b778 in miWindowExposures (pWin=0x19a04d0, prgn=0x23e3b30, 
    other_exposed=0x0) at miexpose.c:470
#6  0x00000000005a3948 in miHandleValidateExposures (pWin=0x1a371b0)
    at miwindow.c:223
#7  0x000000000046679f in MapWindow (pWin=0x19a04d0, client=0x19fd3c0)
    at window.c:2582

(gdb) print *pBox
$5 = {x1 = 941, y1 = -19, x2 = 945, y2 = 5}

(note that the int is copied in a uint32 of compat_qxl_rect and then copied back to an int in qemu...)

The new revision driver doesn't reach this condition in the PolyFillRect implementation, probably because of real or "fake" offscreen surface implementation.

It seems remving the qxl code in compat_qxl_poly_fill_rect() doesn't change the drawing result or create artefacts (even with bare X applications, such as xclock). I would propose that fix for xorg-qxl driver.

However, we need to add more checks in server the server to prevent guest from crashing host qemu.

Comment 4 Marc-Andre Lureau 2014-09-05 21:11:32 UTC
xorg qxl driver build provided for rebase #1078390 shouldn't reach that issue. The server remains to be made more robust by adding checks of drawable->bbox against the surface it is operating with.

Comment 11 errata-xmlrpc 2015-07-22 07:28:25 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1394.html


Note You need to log in before you can comment on or make changes to this bug.