hw/qxl: guest bug on primary create with stride %4 != 0
Due to usage of pixman for rendering on all spice surfaces we have pixman's requirement that the stride be word aligned. A guest not honoring that can crash spice and qemu with it due to failure to create a surface (in spice-server). Avoid this early on in primary surface creation and offscreen surface creation. Recently windows guests got odd width support which triggers a non word aligned primary surface in 16bit color depth. Off screen surfaces have always been word aligned, but doesn't hurt to check them here too. Signed-off-by: Alon Levy <alevy@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
parent
1cfd981ff1
commit
48f4ba671b
12
hw/qxl.c
12
hw/qxl.c
|
@ -447,6 +447,12 @@ static int qxl_track_command(PCIQXLDevice *qxl, struct QXLCommandExt *ext)
|
|||
qxl->ssd.num_surfaces);
|
||||
return 1;
|
||||
}
|
||||
if (cmd->type == QXL_SURFACE_CMD_CREATE &&
|
||||
(cmd->u.surface_create.stride & 0x03) != 0) {
|
||||
qxl_set_guest_bug(qxl, "QXL_CMD_SURFACE stride = %d %% 4 != 0\n",
|
||||
cmd->u.surface_create.stride);
|
||||
return 1;
|
||||
}
|
||||
qemu_mutex_lock(&qxl->track_lock);
|
||||
if (cmd->type == QXL_SURFACE_CMD_CREATE) {
|
||||
qxl->guest_surfaces.cmds[id] = ext->cmd.data;
|
||||
|
@ -1357,6 +1363,12 @@ static void qxl_create_guest_primary(PCIQXLDevice *qxl, int loadvm,
|
|||
trace_qxl_create_guest_primary_rest(qxl->id, sc->stride, sc->type,
|
||||
sc->flags);
|
||||
|
||||
if ((surface.stride & 0x3) != 0) {
|
||||
qxl_set_guest_bug(qxl, "primary surface stride = %d %% 4 != 0",
|
||||
surface.stride);
|
||||
return;
|
||||
}
|
||||
|
||||
surface.mouse_mode = true;
|
||||
surface.group_id = MEMSLOT_GROUP_GUEST;
|
||||
if (loadvm) {
|
||||
|
|
Loading…
Reference in a new issue