Spice: handle_dev_destroy_surface_wait: condition `msg->surface_id == 0' failed (DoS via assert failure)
Host environment
-
Operating system: Debian 12
-
OS/kernel version: Kernel: Linux 6.1.0-11-amd64
-
Architecture: x86_64
-
QEMU flavor: qemu/master
-
QEMU version: version 8.1.50 (v8.1.0-1353-g 2f3913f4-dirty), commit 2f3913f4
-
QEMU command line:
./qemu-system-x86_64 -vga qxl -m 2048 -nodefaults
Emulated/Virtualized environment
Does not matter
Description of problem
Assert failure in libspice-server was found during fuzzing qxl-vga device.
qemu-system-x86_64: Spice: ../server/red-worker.cpp:367:handle_dev_destroy_surface_wait: condition `msg->surface_id == 0' failed
Аварийный останов
Steps to reproduce
-
This bug can be reroduced with
cat << EOF | ./qemu-system-x86_64 -display none -machine accel=qtest, -m 512M -M \ pc -nodefaults -vga qxl -qtest stdio outl 0xcf8 0x8000101c outl 0xcfc 0xc000 outl 0xcf8 0x80001004 outw 0xcfc 0x01 outl 0xc00b 0x01000000 EOF
-
This bug is in another place from #1829 (closed), please pay attention to it. It has to be solved, because it interferes with further fuzzing process
Additional information
As I mentioned, I really need this bug to be solved, because fuzzing qxl-vga device gets less efficient. I suggested to report it here, not in spice-server, because this bug can be on the QEMU side.