Re: [Qemu-devel] Re: Another VNC crash, qemu-kvm-0.12.3

[Alexander Graf]

On 05.03.2010, at 17:52, Chris Webb wrote:

> Anthony Liguori <address@hidden> writes:
> 
>> On 03/01/2010 12:14 PM, Chris Webb wrote:
>>> We've just seen another VNC related qemu-kvm crash, this time an arithmetic
>>> exception at vnc.c:1424 in the newly release qemu-kvm 0.12.3.
>>> 
>>>  [...]
>>>  1423     if (vs->absolute) {
>>>  1424         kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
>>>  1425                         y * 0x7FFF / (ds_get_height(vs->ds) - 1),
>>>  1426                         dz, buttons);
>>>  1427     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
>>>  1428         x -= 0x7FFF;
>>>  [...]
>>> 
>>> and sure enough:
>>> 
>>>  (gdb) p vs->ds->surface->width
>>>  $1 = 9
>>>  (gdb) p vs->ds->surface->height
>>>  $2 = 1
>>> 
>>> What a 9x1 display surface is doing on this guest is a mystery to me, but 
>>> you
>>> definitely can't divide by one less than its height!
>> 
>> Can you reproduce this reliably?  If so, what's the procedure?
> 
> No, I'm afraid not, although I have had a thorough play myself with a variety
> of VNC clients in an attempt to reproduce.
> 
> The background here is that we're running a public hosting service where
> customers can install and run their own OSes on their own qemu-kvm virtual
> machines. I don't even know what VNC client (if any) was connected at the
> time. I only see the core dump if the qemu-kvm crashes.
> 
> Of course, if the screen width or height is 1, it doesn't really matter what
> the value of the mouse position for the click is, so something as simple as
> 
> diff --git a/vnc.c b/vnc.c
> --- a/vnc.c
> +++ b/vnc.c
> @@ -1421,8 +1421,10 @@
>         dz = 1;
> 
>     if (vs->absolute) {
> -        kbd_mouse_event(x * 0x7FFF / (ds_get_width(vs->ds) - 1),
> -                        y * 0x7FFF / (ds_get_height(vs->ds) - 1),
> +        kbd_mouse_event(ds_get_width(vs->ds) > 1 ?
> +                          x * 0x7FFF / (ds_get_width(vs->ds) - 1) : 0x4000,
> +                        ds_get_height(vs->ds) > 1 ?
> +                          y * 0x7FFF / (ds_get_height(vs->ds) - 1) : 0x4000,
>                         dz, buttons);
>     } else if (vnc_has_feature(vs, VNC_FEATURE_POINTER_TYPE_CHANGE)) {
>         x -= 0x7FFF;
> 
> will fix the symptom: the division by zero. The underlying cause of a 9x1
> display surface is a bit mysterious though.

Is it? When booting the screen gets resized to something like 9x1 for a few ms. 
Try putting debug code in the resize callback - you'll see it.

Alex