diff options
| author | Alon Levy <alevy@redhat.com> | 2012-10-15 14:54:03 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2012-11-05 11:49:21 +0100 |
| commit | 48f4ba671bbb3dd212002d57b72a23375f51619b (patch) | |
| tree | 71797b6ea1c0b72b9f0df6e20e27b207b10d5153 /hw/qxl.c | |
| parent | 1cfd981ff1e8ff0858cd71cfae0c7c7ba741f380 (diff) | |
| download | focaccia-qemu-48f4ba671bbb3dd212002d57b72a23375f51619b.tar.gz focaccia-qemu-48f4ba671bbb3dd212002d57b72a23375f51619b.zip | |
hw/qxl: guest bug on primary create with stride %4 != 0
Due to usage of pixman for rendering on all spice surfaces we have pixman's requirement that the stride be word aligned. A guest not honoring that can crash spice and qemu with it due to failure to create a surface (in spice-server). Avoid this early on in primary surface creation and offscreen surface creation. Recently windows guests got odd width support which triggers a non word aligned primary surface in 16bit color depth. Off screen surfaces have always been word aligned, but doesn't hurt to check them here too. Signed-off-by: Alon Levy <alevy@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw/qxl.c')
| -rw-r--r-- | hw/qxl.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/hw/qxl.c b/hw/qxl.c index 1f56fcd169..cc16eaf2aa 100644 --- a/hw/qxl.c +++ b/hw/qxl.c @@ -447,6 +447,12 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext) qxl->ssd.num_surfaces); return 1; } + if (cmd->type == QXL_SURFACE_CMD_CREATE && + (cmd->u.surface_create.stride & 0x03) != 0) { + qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n", + cmd->u.surface_create.stride); + return 1; + } qemu_mutex_lock(&qxl->track_lock); if (cmd->type == QXL_SURFACE_CMD_CREATE) { qxl->guest_surfaces.cmds[id] = ext->cmd.data; @@ -1357,6 +1363,12 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm, trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type, sc->flags); + if ((surface.stride & 0x3) != 0) { + qxl_set_guest_bug(qxl, "primary surface stride = %d %% 4 != 0", + surface.stride); + return; + } + surface.mouse_mode = true; surface.group_id = MEMSLOT_GROUP_GUEST; if (loadvm) { |