[Qemu-devel] [PULL 1/1] qxl: keep going if reaching guest bug on empty area

[Gerd Hoffmann <kraxel@redhat.com>]

From: Marc-André Lureau <marcandre.lureau@gmail.com>

Xorg server hangs when using xfig and typing a text with space:
 #0  qxl_wait_for_io_command (qxl=<value optimized out>) at qxl_io.c:47
 #1  0x00007f826a49a299 in qxl_download_box (surface=0x221d030, x1=231, y1=259,
     x2=<value optimized out>, y2=<value optimized out>) at qxl_surface.c:143

       while (!(ram_header->int_pending & QXL_INTERRUPT_IO_CMD))
         usleep (1);

The QXL driver is calling QXL_IO_UPDATE_AREA with an empty area. This
is a guest bug. The call is async and no ack is sent back on guest
bug, so the X server will hang. The driver should be improved to avoid
this situation and also to abort on QXL_INTERRUPT_ERROR. This will be
a different patch series for the driver. However, it is simple enough
to keep qemu running on empty areas update, which is what this patch
provides.

https://bugzilla.redhat.com/show_bug.cgi?id=1151363

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/display/qxl.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 93b3518..b540dd6 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -1591,6 +1591,11 @@ async_common:
             qxl_set_guest_bug(d,
                     "QXL_IO_UPDATE_AREA: invalid area (%ux%u)x(%ux%u)\n",
                     update.left, update.top, update.right, update.bottom);
+            if (update.left == update.right || update.top == update.bottom) {
+                /* old drivers may provide empty area, keep going */
+                qxl_clear_guest_bug(d);
+                goto cancel_async;
+            }
             break;
         }
         if (async == QXL_ASYNC) {
-- 
1.8.3.1