Hi Andrey On Tue, Aug 25, 2026 at 9:26 PM Andrey Drobyshev <[email protected]> wrote: > > We've experienced crashes when spice-server aborts on migration target > when processing an invalid/stale guest address pointer. While those are > hard to reproduce, it seems they can be fairly easily avoided by simply > skipping commands with invalid addresses in qxl_post_load.
I would rather try to find the root cause, rather than applying a post-load workaround. It may be related to this issue https://gitlab.com/qemu-project/qemu/-/work_items/3766 (confidential): there is a lack of resource tracking, when a guest release slot/cursors etc, the track commands may not be correctly updated - or preventing resource release. Unfortunately, spice/qxl is no longer maintained - we should clearly mark this device as unsecure imho. > Andrey Drobyshev (3): > hw/display/qxl: factor out qxl_guest_phys2virt() > hw/display/qxl: validate replayed commands in qxl_post_load > hw/display/qxl: trace skipped stale loadvm commands > > hw/display/qxl.c | 132 +++++++++++++++++++++++++++++----------- > hw/display/trace-events | 1 + > 2 files changed, 97 insertions(+), 36 deletions(-) > > -- > 2.47.1 > >
