This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 891326 - spice-server crash when trying on guest (XP) to change settings of "3D Flying Objects" screen-saver
spice-server crash when trying on guest (XP) to change settings of "3D Flying...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: spice-server (Show other bugs)
6.4
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Uri Lublin
Desktop QE
: Regression
Depends On:
Blocks: 895654
  Show dependency treegraph
 
Reported: 2013-01-02 10:50 EST by Uri Lublin
Modified: 2013-07-03 08:19 EDT (History)
12 users (show)

See Also:
Fixed In Version: spice-server-0.12.0-11.el6
Doc Type: Bug Fix
Doc Text:
Cause: - General: Trying to change settings of "3D Flying Objects" screen-saver (and others) made spice-server access already freed pointers. - More technical: Inserting a new image into spice-tree may result in drawing of an area containing the new image. Also it may cause stopping video streams that intersect with that area. Drawing the area after detaching video streams, may have caused spice-server to access already freed memory. Consequence: spice-server crashed. Fix: The order of operation has changed. First insert the image into spice-tree (which may cause drawing of the area), and then detach the video streams. Result: Spice-server does not crash.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 05:04:12 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
fixing patch (7.96 KB, patch)
2013-01-08 13:12 EST, Yonit Halperin
no flags Details | Diff
screen recording (1.11 MB, video/mp4)
2013-01-15 09:50 EST, David Jaša
no flags Details

  None (edit)
Description Uri Lublin 2013-01-02 10:50:13 EST
Description of problem:
spice-server crash when trying to set properties of 3d screen-saver.


Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffeccca700 (LWP 31320)]
__current_add_drawable (worker=0x7fff980008c0, ring=0x7fff98376db8, drawable=0x7fff9818fca8) at red_worker.c:2363
2363	    ring_add_after(&drawable->tree_item.base.siblings_link, pos);

(gdb) bt
#0  __current_add_drawable (worker=0x7fff980008c0, ring=0x7fff98376db8, drawable=0x7fff9818fca8)
    at red_worker.c:2363
#1  red_current_add (worker=0x7fff980008c0, ring=0x7fff98376db8, drawable=0x7fff9818fca8) at red_worker.c:3491
#2  0x00007ffff5f7c111 in red_current_add_qxl (worker=0x7fff980008c0, ring_is_empty=0x7fffeccc9bdc, max_pipe_size=
    50) at red_worker.c:3624
#3  red_process_drawable (worker=0x7fff980008c0, ring_is_empty=0x7fffeccc9bdc, max_pipe_size=50)
    at red_worker.c:3965
#4  red_process_commands (worker=0x7fff980008c0, ring_is_empty=0x7fffeccc9bdc, max_pipe_size=50)
    at red_worker.c:4908
#5  0x00007ffff5f7edea in red_worker_main (arg=<value optimized out>) at red_worker.c:11842
#6  0x00007ffff773a851 in start_thread (arg=0x7fffeccca700) at pthread_create.c:301
#7  0x00007ffff57fb90d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:115
(gdb) 


Version-Release number of selected component (if applicable):
$ rpm -q spice-server qemu-kvm
spice-server-0.12.0-10.el6.x86_64
qemu-kvm-0.12.1.2-2.348.el6.x86_64


How reproducible:
very reproducible, always fail.
sometimes instead of crashing, spice-server aborts.
sometimes steps 4-5 below need to be done twice (chose a different 3d screen saver).

Steps to Reproduce:
1. Start a guest running Windows XP (log in if needed)
2. Right-click the desktop and chose "Properties"
3. Click on the "Screen Saver" tab
4. Chose the "3D Flying Objects" screen-saver from the drop-down
5. Click "Settings"
6. spice-server segfaults
Comment 2 Uri Lublin 2013-01-06 11:06:18 EST
bisecting shows the first bad commit is:
  81fe00b08ad4f8abe848f9840c4879e8c1e645c1
  server/red_worker/video: upgrade stream by a screenshot
  instead of the last frame, if needed
Comment 3 Yonit Halperin 2013-01-08 13:12:52 EST
Created attachment 674984 [details]
fixing patch

I posted the attached patch upstream
Comment 5 David Jaša 2013-01-15 09:50:48 EST
Created attachment 678812 [details]
screen recording

In spice-server-0.12.0-10, I've encoutered freezes in the scenario but not asserts (maybe caused by using clean VM without QXL driver).

The freezes are gone in -11 but I encountered cosmetic problem: when running the reproducer the very first time, the graphics of guest flashes no matter what driver is used (qxl or generic vga) as in video. When doing it second time, no such thing occurs.
Comment 6 Yonit Halperin 2013-01-15 14:00:52 EST
(In reply to comment #5)
> Created attachment 678812 [details]
> screen recording
> 
> In spice-server-0.12.0-10, I've encoutered freezes in the scenario but not
> asserts (maybe caused by using clean VM without QXL driver).
> 
You must install qxl driver in order to reproduce 

> The freezes are gone in -11 but I encountered cosmetic problem: when running
> the reproducer the very first time, the graphics of guest flashes no matter
> what driver is used (qxl or generic vga) as in video. When doing it second
> time, no such thing occurs.
Are you referring to the flash that occur when you just choose the screen saver in the list? and What do you mean by "as in video"? In any case I'm not sure it is a bug, and if it is a bug, I don't think it is related to the one discussed. Did this flash happen before the fix (with an older spice-server and all the tools installed)? Did it happen just as you opened the client, or was the client already opened for a while? Does it happen without agent running?
Comment 7 David Jaša 2013-01-16 12:30:03 EST
(In reply to comment #6)
> > In spice-server-0.12.0-10, I've encoutered freezes in the scenario but not
> > asserts (maybe caused by using clean VM without QXL driver).
> > 
> You must install qxl driver in order to reproduce 

As such, I'll mark the bug as verified because the asserts didn't occur with -11 server and qxl driver installed.

> > The freezes are gone in -11 but I encountered cosmetic problem: when running
> > the reproducer the very first time, the graphics of guest flashes no matter
> > what driver is used (qxl or generic vga) as in video. When doing it second
> > time, no such thing occurs.
> Are you referring to the flash that occur when you just choose the screen
> saver in the list? 

Yes.

> and What do you mean by "as in video"?

"what you can see in the recorded video".

> In any case I'm
> not sure it is a bug, and if it is a bug, I don't think it is related to the
> one discussed. Did this flash happen before the fix (with an older
> spice-server and all the tools installed)?

No idea and I have no resources to try it right now.

> Did it happen just as you opened
> the client, or was the client already opened for a while?

It didn't seem to have any influence at all as well as driver used. What did matter was if you did the same before: if you selected the screen saver the very first time in VM life, the flash occurred, when it was 2nd or any later try, the flash didn't happen.

> Does it happen without agent running?

No, agent wasn't running at either case.

One more observation: the same flash occurs usually when the driver is being installed (no matter if via RHEV Tools or manually via Device Manager -> Update Driver).
Comment 10 errata-xmlrpc 2013-02-21 05:04:12 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0529.html

Note You need to log in before you can comment on or make changes to this bug.