RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 590068 - GTK-VNC does not do proper bounds checking on framebuffer updates
Summary: GTK-VNC does not do proper bounds checking on framebuffer updates
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: gtk-vnc
Version: 6.0
Hardware: All
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: Daniel Berrangé
QA Contact: desktop-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-05-07 16:10 UTC by Daniel Berrangé
Modified: 2010-11-15 13:58 UTC (History)
2 users (show)

Fixed In Version: gtk-vnc-0.3.10-2.el6
Doc Type: Bug Fix
Doc Text:
Clone Of: 540810
Environment:
Last Closed: 2010-11-15 13:58:38 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
Do bounds checking on framebuffer updates (6.45 KB, patch)
2010-05-13 09:52 UTC, Daniel Berrangé
no flags Details | Diff

Description Daniel Berrangé 2010-05-07 16:10:17 UTC
+++ This bug was initially created as a clone of Bug #540810 +++

abrt detected a crash.

Attached file: backtrace
cmdline: python /usr/share/virt-manager/virt-manager.py
component: python
executable: /usr/bin/python
kernel: 2.6.31.5-127.fc12.i686.PAE
package: python-2.6.2-2.fc12
rating: 4
reason: Process was terminated by signal 6

--- Additional comment from thanosk on 2009-11-24 03:42:28 EST ---

Created an attachment (id=373362)
File: backtrace

--- Additional comment from dmalcolm on 2009-11-30 22:05:57 EST ---

Thank you for reporting this bug.

How reproducable is this problem?  If you run the program from a terminal, is an error message printed?

What version of virt-manager do you have installed?

Looking at the backtrace, it looks like a fatal error happened in frame 5 of the program's single thread inside gdk_x_error.

Reassigning component from "python" to "virt-manager"


--- Additional comment from crobinso on 2010-04-12 20:02:01 EDT ---

Created an attachment (id=406117)
virt-manager --sync backtrace from gdk_x_error

Okay, I can reproduce pretty consistently on a fully updated F12 machine:

1) In Edit->Preferences, set 'Automatically open consoles' to 'For all domains'
2) Use a script that starts and stops a couple domains every few seconds, which causes the VNC windows to pop up in virt-manager.
3) Click around a bit during all this

Has triggered reliably within 2 minutes every time.

Danpb, the backtrace is in gtk-vnc code, can you make sense of it? Anything else I can do to provide more info?

--- Additional comment from berrange on 2010-04-26 14:24:59 EDT ---

I have finally reproduced this problem with virt-viewer too. There are two bugs involved.

 1. The root cause is that QEMU is forgetting to send a DESKTOPRESIZE message if the guest resizes the guest at the time the VNC connection is still in its setup phase. This is incredibly unlikely to occur, unless your VNC client happens to connect at exactly the time the guest resizes its display. Unfortunately when a guest first boots there are typically 2-3 resizes from BIOS to GRUB to guest OS. With virt-manager automagically opening connections when a guest starts the odds of hitting the QEMU flaw are non-trivial

 2. GTK-VNC is not checking the bounds of the framebuffer updates against its known framebuffer size. Thus it tries to draw a 720x400 pixel image on a 600x480 pixel window. X gets unhappy, sends back an XError and GTK gives up & aborts the whole process.

I'm going to fix GTK-VNC to check update boundaries & close the VNC connection if it gets an out of bounds update. virt-manager should auto-reopen the VNC connection and all will likely be well since its past the resize. I'm also going to take the QEMU problem upstream.

Comment 1 RHEL Program Management 2010-05-07 16:31:41 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.

Comment 2 Daniel Berrangé 2010-05-13 09:52:57 UTC
Created attachment 413701 [details]
Do bounds checking on framebuffer updates

Comment 3 Daniel Berrangé 2010-05-13 15:06:48 UTC
Fix built in gtk-vnc-0.3.10-2.el6

Comment 5 Radek Lat 2010-10-11 09:38:55 UTC
Could you please retest with the latest RC?
http://download.devel.redhat.com/rel-eng/RHEL6.0-RC-4/

Comment 6 Daniel Berrangé 2010-10-13 14:53:17 UTC
NB, the original QEMU bug that exposed this problem is now solved, so current QEMU won't reproduce the bug. Testing with the original broken QEMU and fixed GTK-VNC shows this issue fixed.

Comment 7 Radek Lat 2010-10-13 14:58:32 UTC
Thank you for your report.

Comment 8 releng-rhel@redhat.com 2010-11-15 13:58:38 UTC
Red Hat Enterprise Linux 6.0 is now available and should resolve
the problem described in this bug report. This report is therefore being closed
with a resolution of CURRENTRELEASE. You may reopen this bug report if the
solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.