RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1135372 - Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump
Summary: Machine type rhel6.0.0 & -vga qxl & vnc cause qemu-kvm core dump
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: spice-server
Version: 6.6
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Christophe Fergeau
QA Contact: SPICE QE bug list
URL:
Whiteboard:
Depends On:
Blocks: 1052856
TreeView+ depends on / blocked
 
Reported: 2014-08-29 07:35 UTC by Gerd Hoffmann
Modified: 2015-07-22 07:28 UTC (History)
17 users (show)

Fixed In Version: spice-server-0.12.4-12.el6
Doc Type: Bug Fix
Doc Text:
* Prior to this update, when using the "rhel6.0.0" Quick Emulator (QEMU) machine type, the guest could receive invalid drawing commands. Consequently, spice-server terminated unexpectedly. With this update, spice-server detects these invalid drawing commands and ignores them. As a result, spice-server no longer crashes when using the "rhel6.0.0" QEMU machine type. (BZ#1135372)
Clone Of: 1095612
Environment:
Last Closed: 2015-07-22 07:28:25 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1394 0 normal SHIPPED_LIVE spice-server bug fix update 2015-07-20 17:58:02 UTC

Comment 1 Gerd Hoffmann 2014-08-29 07:37:06 UTC 
See last comment from original bug.  spice-server should never pass us negative values.
Comment 3 Marc-Andre Lureau 2014-09-05 00:30:00 UTC 
The origin of the invilid drawing is 

#0  make_drawable (compat_qxl=0x1332840, type=1 '\001', rect=0x7fff86e33d30)
    at compat-qxl_driver.c:393
#1  0x00007f7a6e9928cf in submit_fill (compat_qxl=0x1332840, 
    rect=0x7fff86e33d30, color=0) at compat-qxl_driver.c:449
#2  0x00007f7a6e993146 in compat_qxl_poly_fill_rect (pDrawable=0x19a04d0, 
    pGC=0x1383de0, nrect=1, prect=0x1a37010) at compat-qxl_driver.c:735
#3  0x000000000052c57d in damagePolyFillRect (pDrawable=0x19a04d0, 
    pGC=0x1383de0, nRects=1, pRects=<value optimized out>) at damage.c:1194
#4  0x000000000058b22a in miPaintWindow (pWin=<value optimized out>, 
    prgn=<value optimized out>, what=<value optimized out>) at miexpose.c:641
#5  0x000000000058b778 in miWindowExposures (pWin=0x19a04d0, prgn=0x23e3b30, 
    other_exposed=0x0) at miexpose.c:470
#6  0x00000000005a3948 in miHandleValidateExposures (pWin=0x1a371b0)
    at miwindow.c:223
#7  0x000000000046679f in MapWindow (pWin=0x19a04d0, client=0x19fd3c0)
    at window.c:2582

(gdb) print *pBox
$5 = {x1 = 941, y1 = -19, x2 = 945, y2 = 5}

(note that the int is copied in a uint32 of compat_qxl_rect and then copied back to an int in qemu...)

The new revision driver doesn't reach this condition in the PolyFillRect implementation, probably because of real or "fake" offscreen surface implementation.

It seems remving the qxl code in compat_qxl_poly_fill_rect() doesn't change the drawing result or create artefacts (even with bare X applications, such as xclock). I would propose that fix for xorg-qxl driver.

However, we need to add more checks in server the server to prevent guest from crashing host qemu.
Comment 4 Marc-Andre Lureau 2014-09-05 21:11:32 UTC 
xorg qxl driver build provided for rebase #1078390 shouldn't reach that issue. The server remains to be made more robust by adding checks of drawable->bbox against the surface it is operating with.
Comment 5 Christophe Fergeau 2014-09-24 10:53:40 UTC 
Upstream commit is http://cgit.freedesktop.org/spice/spice/commit/?id=e270edcbfd958d764e84cdbca6d403ff24fef610
Comment 11 errata-xmlrpc 2015-07-22 07:28:25 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1394.html
Note You need to log in before you can comment on or make changes to this bug.