Hi Andrey

On Tue, Aug 25, 2026 at 9:26 PM Andrey Drobyshev
<[email protected]> wrote:
>
> We've experienced crashes when spice-server aborts on migration target
> when processing an invalid/stale guest address pointer.  While those are
> hard to reproduce, it seems they can be fairly easily avoided by simply
> skipping commands with invalid addresses in qxl_post_load.

I would rather try to find the root cause, rather than applying a
post-load workaround. It may be related to this issue
https://gitlab.com/qemu-project/qemu/-/work_items/3766 (confidential):
there is a lack of resource tracking, when a guest release
slot/cursors etc, the track commands may not be correctly updated - or
preventing resource release. Unfortunately, spice/qxl is no longer
maintained - we should clearly mark this device as unsecure imho.

> Andrey Drobyshev (3):
>   hw/display/qxl: factor out qxl_guest_phys2virt()
>   hw/display/qxl: validate replayed commands in qxl_post_load
>   hw/display/qxl: trace skipped stale loadvm commands
>
>  hw/display/qxl.c        | 132 +++++++++++++++++++++++++++++-----------
>  hw/display/trace-events |   1 +
>  2 files changed, 97 insertions(+), 36 deletions(-)
>
> --
> 2.47.1
>
>

Reply via email to