[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 1/7] hw/qxl: guest bug on primary create with stride
From: |
Gerd Hoffmann |
Subject: |
[Qemu-devel] [PATCH 1/7] hw/qxl: guest bug on primary create with stride %4 != 0 |
Date: |
Fri, 2 Nov 2012 10:35:13 +0100 |
From: Alon Levy <address@hidden>
Due to usage of pixman for rendering on all spice surfaces we have
pixman's requirement that the stride be word aligned. A guest not
honoring that can crash spice and qemu with it due to failure to create
a surface (in spice-server). Avoid this early on in primary surface
creation and offscreen surface creation.
Recently windows guests got odd width support which triggers a non word
aligned primary surface in 16bit color depth. Off screen surfaces have
always been word aligned, but doesn't hurt to check them here too.
Signed-off-by: Alon Levy <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
---
hw/qxl.c | 12 ++++++++++++
1 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/hw/qxl.c b/hw/qxl.c
index 1f56fcd..cc16eaf 100644
--- a/hw/qxl.c
+++ b/hw/qxl.c
@@ -447,6 +447,12 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct
QXLCommandExt *ext)
qxl->ssd.num_surfaces);
return 1;
}
+ if (cmd->type == QXL_SURFACE_CMD_CREATE &&
+ (cmd->u.surface_create.stride & 0x03) != 0) {
+ qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",
+ cmd->u.surface_create.stride);
+ return 1;
+ }
qemu_mutex_lock(&qxl->track_lock);
if (cmd->type == QXL_SURFACE_CMD_CREATE) {
qxl->guest_surfaces.cmds[id] = ext->cmd.data;
@@ -1357,6 +1363,12 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl,
int loadvm,
trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type,
sc->flags);
+ if ((surface.stride & 0x3) != 0) {
+ qxl_set_guest_bug(qxl, "primary surface stride = %d %% 4 != 0",
+ surface.stride);
+ return;
+ }
+
surface.mouse_mode = true;
surface.group_id = MEMSLOT_GROUP_GUEST;
if (loadvm) {
--
1.7.1
- [Qemu-devel] [PULL 0/7] spice patch queue, Gerd Hoffmann, 2012/11/02
- [Qemu-devel] [PATCH 3/7] qxl: fix cursor reset, Gerd Hoffmann, 2012/11/02
- [Qemu-devel] [PATCH 2/7] hw/qxl: qxl_send_events: nop if stopped, Gerd Hoffmann, 2012/11/02
- [Qemu-devel] [PATCH 5/7] spice: switch to pixman, Gerd Hoffmann, 2012/11/02
- [Qemu-devel] [PATCH 1/7] hw/qxl: guest bug on primary create with stride %4 != 0,
Gerd Hoffmann <=
- [Qemu-devel] [PATCH 7/7] spice: fix initialization order, Gerd Hoffmann, 2012/11/02
- [Qemu-devel] [PATCH 4/7] qxl: call dpy_gfx_resize when entering vga mode, Gerd Hoffmann, 2012/11/02
- [Qemu-devel] [PATCH 6/7] pflib: unused, remove it., Gerd Hoffmann, 2012/11/02
- Re: [Qemu-devel] [PULL 0/7] spice patch queue, Gerd Hoffmann, 2012/11/05
- Re: [Qemu-devel] [PULL 0/7] spice patch queue, Anthony Liguori, 2012/11/14