Commit 48f4ba67 authored by Alon Levy's avatar Alon Levy Committed by Gerd Hoffmann
Browse files

hw/qxl: guest bug on primary create with stride %4 != 0 



Due to usage of pixman for rendering on all spice surfaces we have
pixman's requirement that the stride be word aligned. A guest not
honoring that can crash spice and qemu with it due to failure to create
a surface (in spice-server). Avoid this early on in primary surface
creation and offscreen surface creation.

Recently windows guests got odd width support which triggers a non word
aligned primary surface in 16bit color depth. Off screen surfaces have
always been word aligned, but doesn't hurt to check them here too.

Signed-off-by: default avatarAlon Levy <alevy@redhat.com>
Signed-off-by: default avatarGerd Hoffmann <kraxel@redhat.com>
parent 1cfd981f

hw/qxl.c

+12 −0
Original line number Diff line number Diff line
@@ -447,6 +447,12 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) 
                              qxl->ssd.num_surfaces);

            return 1;

        }

        if (cmd->type == QXL_SURFACE_CMD_CREATE &&

            (cmd->u.surface_create.stride & 0x03) != 0) {

            qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",

                              cmd->u.surface_create.stride);

            return 1;

        }

        qemu_mutex_lock(&qxl->track_lock);

        if (cmd->type == QXL_SURFACE_CMD_CREATE) {

            qxl->guest_surfaces.cmds[id] = ext->cmd.data;
@@ -1357,6 +1363,12 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, 
    trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type,

                                        sc->flags);



    if ((surface.stride & 0x3) != 0) {

        qxl_set_guest_bug(qxl, "primary surface stride = %d %% 4 != 0",

                          surface.stride);

        return;

    }



    surface.mouse_mode = true;

    surface.group_id   = MEMSLOT_GROUP_GUEST;

    if (loadvm) {