null pointer access on migration resume of systemrescuecd boot menu with qxl-vga
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
With qemu-2.8.0 up to 2.9.0-rc2 and git master (6954cdc), when resuming from a migration state file created from a VM suspended while showing the System Rescue CD 4.9.2 boot menu and using the QXL VGA device, I get a null point access in pixman_
Here is the valgrind trace from the git version:
==2634== Thread 1:
==2634== Invalid read of size 4
==3516== at 0x65F3050: pixman_
==3516== by 0x6F0CEB: qemu_spice_
==3516== by 0x6F1CC7: qemu_spice_
==3516== by 0x58CF77: display_refresh (qxl.c:1948)
==3516== by 0x6E8084: do_safe_dpy_refresh (console.c:1591)
==3516== by 0x6E80D5: dpy_refresh (console.c:1604)
==3516== by 0x6E4508: gui_update (console.c:201)
==3516== by 0x81898E: timerlist_
==3516== by 0x8189D6: qemu_clock_
==3516== by 0x818D98: qemu_clock_
==3516== by 0x81952A: main_loop_wait (main-loop.c:514)
==3516== by 0x4ADD29: main_loop (vl.c:1898)
Minimal steps to reproduce:
Compile (debug compile flags are just so valgrind works, the crash occurs with non-debug compile flags as well):
CFLAGS="-g -O0" CXXFLAGS="-g -O0" ./configure --target-
./configure
make
Start VM and leave it on the System Rescue CD graphical boot menu:
x86_64-
Suspend VM and save state:
socat - unix:monitor.sock
stop
migrate "exec:cat > vm.state"
quit
Attempt to resume VM (but this crashes):
x86_64-
Yep, I can repeat this here on qemu head; crash at:
pixman_ image_get_ data (image=0x0) at pixman-image.c:845
845 if (image->type == BITS)
(gdb) p image
$1 = (pixman_image_t *) 0x0