We've experienced crashes when spice-server aborts on migration target when processing an invalid/stale guest address pointer. While those are hard to reproduce, it seems they can be fairly easily avoided by simply skipping commands with invalid addresses in qxl_post_load.
Andrey Drobyshev (3): hw/display/qxl: factor out qxl_guest_phys2virt() hw/display/qxl: validate replayed commands in qxl_post_load hw/display/qxl: trace skipped stale loadvm commands hw/display/qxl.c | 132 +++++++++++++++++++++++++++++----------- hw/display/trace-events | 1 + 2 files changed, 97 insertions(+), 36 deletions(-) -- 2.47.1
