Re: [PATCH 0/3] hw/display/qxl: Avoid crashing on stale guest addresses in qxl_post_load

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

On 8/26/26 11:10 AM, Marc-André Lureau wrote:
> Hi Andrey
> 
> On Tue, Aug 25, 2026 at 9:26 PM Andrey Drobyshev
> <andrey.drobyshev@virtuozzo.com> wrote:
>>
>> We've experienced crashes when spice-server aborts on migration target
>> when processing an invalid/stale guest address pointer.  While those are
>> hard to reproduce, it seems they can be fairly easily avoided by simply
>> skipping commands with invalid addresses in qxl_post_load.
> 
> I would rather try to find the root cause, rather than applying a
> post-load workaround. It may be related to this issue
> https://gitlab.com/qemu-project/qemu/-/work_items/3766 (confidential):
> there is a lack of resource tracking, when a guest release
> slot/cursors etc, the track commands may not be correctly updated - or
> preventing resource release. Unfortunately, spice/qxl is no longer
> maintained - we should clearly mark this device as unsecure imho.
> 
>> [...]
I agree on all points. AFAIU this is a use-after-free of a tracked guest
pointer.  I'm not sure whether we can reliably track whenever guest
frees a buffer, so we drop it from the cmd list.  Still, I'd argue that
my 2nd patch here adds some hardening:

1. Currently we consume guest-controlled bytes which reach
memslot_get_virt() in spice-server, which aborts on the migration
target.  So there's a potential for guest->host DoS.
2. Dropping invalid commands is cheap, as we just don't replay cursor
movements on the target - instead wait until guest sets it again.  IMHO
this kind of hardening would make sense even if we did remedy the root
cause.

Andrey