From 53a939f1bf8e4a3e38f9449fac44f572676966ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Volker=20R=C3=BCmelin?= Date: Sat, 11 Nov 2023 11:40:20 +0100 Subject: [PATCH 1/3] ui/gtk-egl: move function calls back to regular code path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit 6f189a08c1 ("ui/gtk-egl: Check EGLSurface before doing scanout") introduced a regression when QEMU is running with a virtio-gpu-gl-device on a host under X11. After the guest has initialized the virtio-gpu-gl-device, the guest screen only shows "Display output is not active.". Commit 6f189a08c1 moved all function calls in gd_egl_scanout_texture() to a code path which is only called once after gd_egl_init() succeeds in gd_egl_scanout_texture(). Move all function calls in gd_egl_scanout_texture() back to the regular code path so they get always called if one of the gd_egl_init() calls was successful. Fixes: 6f189a08c1 ("ui/gtk-egl: Check EGLSurface before doing scanout") Signed-off-by: Volker Rümelin Reviewed-by: Marc-André Lureau Message-Id: <20231111104020.26183-1-vr_qemu@t-online.de> --- ui/gtk-egl.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c index cd2f176502..3af5ac5bcf 100644 --- a/ui/gtk-egl.c +++ b/ui/gtk-egl.c @@ -249,14 +249,14 @@ void gd_egl_scanout_texture(DisplayChangeListener *dcl, if (!vc->gfx.esurface) { return; } - - eglMakeCurrent(qemu_egl_display, vc->gfx.esurface, - vc->gfx.esurface, vc->gfx.ectx); - - gtk_egl_set_scanout_mode(vc, true); - egl_fb_setup_for_tex(&vc->gfx.guest_fb, backing_width, backing_height, - backing_id, false); } + + eglMakeCurrent(qemu_egl_display, vc->gfx.esurface, + vc->gfx.esurface, vc->gfx.ectx); + + gtk_egl_set_scanout_mode(vc, true); + egl_fb_setup_for_tex(&vc->gfx.guest_fb, backing_width, backing_height, + backing_id, false); } void gd_egl_scanout_dmabuf(DisplayChangeListener *dcl, From ebfbf394671163c14e2b24d98f3927a3151d1aff Mon Sep 17 00:00:00 2001 From: Fiona Ebner Date: Wed, 22 Nov 2023 13:58:26 +0100 Subject: [PATCH 2/3] ui/vnc-clipboard: fix inflate_buffer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Commit d921fea338 ("ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)") removed this hunk, but it is still required, because it can happen that stream.avail_in becomes zero before coming across a return value of Z_STREAM_END in the loop. This fixes the host->guest direction of the clipboard with noVNC and TigerVNC as clients. Fixes: d921fea338 ("ui/vnc-clipboard: fix infinite loop in inflate_buffer (CVE-2023-3255)") Reported-by: Friedrich Weber Signed-off-by: Fiona Ebner Acked-by: Marc-André Lureau Message-Id: <20231122125826.228189-1-f.ebner@proxmox.com> --- ui/vnc-clipboard.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ui/vnc-clipboard.c b/ui/vnc-clipboard.c index c759be3438..124b6fbd9c 100644 --- a/ui/vnc-clipboard.c +++ b/ui/vnc-clipboard.c @@ -69,6 +69,11 @@ static uint8_t *inflate_buffer(uint8_t *in, uint32_t in_len, uint32_t *size) } } + *size = stream.total_out; + inflateEnd(&stream); + + return out; + err_end: inflateEnd(&stream); err: From 551ef0fa05c11abd62f4607ee3cddbcb7dea6b66 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Volker=20R=C3=BCmelin?= Date: Mon, 4 Dec 2023 08:28:37 +0100 Subject: [PATCH 3/3] hw/audio/virtio-sound: mark the device as unmigratable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The virtio-sound device is currently not migratable. QEMU crashes on the source machine at some point during the migration with a segmentation fault. Even with this bug fixed, the virtio-sound device doesn't migrate the state of the audio streams. For example, running streams leave the device on the destination machine in a broken condition. Mark the device as unmigratable until these issues have been fixed. Signed-off-by: Volker Rümelin Reviewed-by: Marc-André Lureau Message-Id: <20231204072837.6058-1-vr_qemu@t-online.de> --- hw/audio/virtio-snd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c index 2fe966e311..b10fad1228 100644 --- a/hw/audio/virtio-snd.c +++ b/hw/audio/virtio-snd.c @@ -68,6 +68,7 @@ static const VMStateDescription vmstate_virtio_snd_device = { static const VMStateDescription vmstate_virtio_snd = { .name = TYPE_VIRTIO_SND, + .unmigratable = 1, .minimum_version_id = VIRTIO_SOUND_VM_VERSION, .version_id = VIRTIO_SOUND_VM_VERSION, .fields = (VMStateField[]) {