[PATCH] ui/spice: fix crash when disabling GL scanout on

[PATCH] ui/spice: fix crash when disabling GL scanout on

[marcandre.lureau]

From: Marc-André Lureau <marcandre.lureau@redhat.com>

When spice_qxl_gl_scanout2() isn't available, the fallback code
incorrectly handles NULL arguments to disable the scanout, leading to:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  spice_server_gl_scanout (qxl=0x55a25ce57ae8, fd=0x0, width=0, height=0, offset=0x0, stride=0x0, num_planes=0, format=0, modifier=72057594037927935, y_0_top=0)
    at ../ui/spice-display.c:983
983         if (num_planes <= 1) {

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2391334
Fixes: 98a050ca93afd8 ("ui/spice: support multi plane dmabuf scanout")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 ui/spice-display.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/spice-display.c b/ui/spice-display.c
index 669832c561..db71e866f8 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -980,7 +980,9 @@ static void spice_server_gl_scanout(QXLInstance *qxl,
     spice_qxl_gl_scanout2(qxl, fd, width, height, offset, stride,
                           num_planes, format, modifier, y_0_top);
 #else
-    if (num_planes <= 1) {
+    if (fd == NULL) {
+        spice_qxl_gl_scanout(qxl, -1, 0, 0, 0, 0, false);
+    } else if (num_planes <= 1) {
         spice_qxl_gl_scanout(qxl, fd[0], width, height, stride[0], format, y_0_top);
     } else {
         error_report("SPICE server does not support multi plane GL scanout");
-- 
2.51.0

Re: [PATCH] ui/spice: fix crash when disabling GL scanout on

[Daniel P. Berrangé]

On Wed, Sep 03, 2025 at 11:38:18PM +0400, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When spice_qxl_gl_scanout2() isn't available, the fallback code
> incorrectly handles NULL arguments to disable the scanout, leading to:
> 
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  spice_server_gl_scanout (qxl=0x55a25ce57ae8, fd=0x0, width=0, height=0, offset=0x0, stride=0x0, num_planes=0, format=0, modifier=72057594037927935, y_0_top=0)
>     at ../ui/spice-display.c:983
> 983         if (num_planes <= 1) {
> 
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2391334
> Fixes: 98a050ca93afd8 ("ui/spice: support multi plane dmabuf scanout")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> ---
>  ui/spice-display.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: [PATCH] ui/spice: fix crash when disabling GL scanout on

[Michael Tokarev]

On 03.09.2025 22:38, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When spice_qxl_gl_scanout2() isn't available, the fallback code
> incorrectly handles NULL arguments to disable the scanout, leading to:
> 
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  spice_server_gl_scanout (qxl=0x55a25ce57ae8, fd=0x0, width=0, height=0, offset=0x0, stride=0x0, num_planes=0, format=0, modifier=72057594037927935, y_0_top=0)
>      at ../ui/spice-display.c:983
> 983         if (num_planes <= 1) {

There's apparently something wrong with the subject line - it seems
to be incomplete.


> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2391334
> Fixes: 98a050ca93afd8 ("ui/spice: support multi plane dmabuf scanout")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3107
Resolves: https://bugs.debian.org/1110512
Resolves: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2121832
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>

And I'm picking this up for qemu-stable too.

Please send a pullreq with this one, as it affects multiple people
already, as can be seen by the number of bug reports in different
places.

Thank you!

/mjt

> diff --git a/ui/spice-display.c b/ui/spice-display.c
> index 669832c561..db71e866f8 100644
> --- a/ui/spice-display.c
> +++ b/ui/spice-display.c
> @@ -980,7 +980,9 @@ static void spice_server_gl_scanout(QXLInstance *qxl,
>       spice_qxl_gl_scanout2(qxl, fd, width, height, offset, stride,
>                             num_planes, format, modifier, y_0_top);
>   #else
> -    if (num_planes <= 1) {
> +    if (fd == NULL) {
> +        spice_qxl_gl_scanout(qxl, -1, 0, 0, 0, 0, false);
> +    } else if (num_planes <= 1) {
>           spice_qxl_gl_scanout(qxl, fd[0], width, height, stride[0], format, y_0_top);
>       } else {
>           error_report("SPICE server does not support multi plane GL scanout");

Re: [PATCH] ui/spice: fix crash when disabling GL scanout on

[Michael Tokarev]

On 03.09.2025 22:38, marcandre.lureau@redhat.com wrote:
> From: Marc-André Lureau <marcandre.lureau@redhat.com>
> 
> When spice_qxl_gl_scanout2() isn't available, the fallback code
> incorrectly handles NULL arguments to disable the scanout, leading to:
> 
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  spice_server_gl_scanout (qxl=0x55a25ce57ae8, fd=0x0, width=0, height=0, offset=0x0, stride=0x0, num_planes=0, format=0, modifier=72057594037927935, y_0_top=0)
>      at ../ui/spice-display.c:983
> 983         if (num_planes <= 1) {
> 
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2391334
> Fixes: 98a050ca93afd8 ("ui/spice: support multi plane dmabuf scanout")
> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>

A friendly ping?

Can we apply this one, so I'll pick it up for stable?

Thanks,

/mjt

> ---
>   ui/spice-display.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/ui/spice-display.c b/ui/spice-display.c
> index 669832c561..db71e866f8 100644
> --- a/ui/spice-display.c
> +++ b/ui/spice-display.c
> @@ -980,7 +980,9 @@ static void spice_server_gl_scanout(QXLInstance *qxl,
>       spice_qxl_gl_scanout2(qxl, fd, width, height, offset, stride,
>                             num_planes, format, modifier, y_0_top);
>   #else
> -    if (num_planes <= 1) {
> +    if (fd == NULL) {
> +        spice_qxl_gl_scanout(qxl, -1, 0, 0, 0, 0, false);
> +    } else if (num_planes <= 1) {
>           spice_qxl_gl_scanout(qxl, fd[0], width, height, stride[0], format, y_0_top);
>       } else {
>           error_report("SPICE server does not support multi plane GL scanout");