From 330481bc1c576fc2bdb1419825e2db134e32ce5a Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Jun 05 2018 18:28:06 +0000
Subject: Fix qxl memslot_get_virt crashes (bz #1565354)


---

diff --git a/0001-qxl-fix-local-renderer-crash.patch b/0001-qxl-fix-local-renderer-crash.patch
new file mode 100644
index 0000000..a839d38
--- /dev/null
+++ b/0001-qxl-fix-local-renderer-crash.patch
@@ -0,0 +1,43 @@
+From 5bd5c27c7d284d01477c5cc022ce22438c46bf9f Mon Sep 17 00:00:00 2001
+Message-Id: <5bd5c27c7d284d01477c5cc022ce22438c46bf9f.1528219523.git.crobinso@redhat.com>
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 27 Apr 2018 13:55:28 +0200
+Subject: [PATCH] qxl: fix local renderer crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Make sure we only ask the spice local renderer for display updates in
+case we have a valid primary surface.  Without that spice is confused
+and throws errors in case a display update request (triggered by
+screendump for example) happens in parallel to a mode switch and hits
+the race window where the old primary surface is gone and the new isn't
+establisted yet.
+
+Cc: qemu-stable@nongnu.org
+Fixes: https://bugzilla.redhat.com//show_bug.cgi?id=1567733
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-id: 20180427115528.345-1-kraxel@redhat.com
+Signed-off-by: Cole Robinson <crobinso@redhat.com>
+---
+ hw/display/qxl-render.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/hw/display/qxl-render.c b/hw/display/qxl-render.c
+index e7ac4f8789..c62b9a5e75 100644
+--- a/hw/display/qxl-render.c
++++ b/hw/display/qxl-render.c
+@@ -169,7 +169,8 @@ void qxl_render_update(PCIQXLDevice *qxl)
+ 
+     qemu_mutex_lock(&qxl->ssd.lock);
+ 
+-    if (!runstate_is_running() || !qxl->guest_primary.commands) {
++    if (!runstate_is_running() || !qxl->guest_primary.commands ||
++        qxl->mode == QXL_MODE_UNDEFINED) {
+         qxl_render_update_area_unlocked(qxl);
+         qemu_mutex_unlock(&qxl->ssd.lock);
+         return;
+-- 
+2.17.1
+
diff --git a/qemu.spec b/qemu.spec
index 71c07a1..355eac2 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -104,7 +104,7 @@ Requires: %{name}-ui-sdl = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 2.12.0
-Release: 1%{?rcrel}%{?dist}
+Release: 2%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2 and BSD and MIT and CC-BY
 URL: http://www.qemu.org/
@@ -137,6 +137,9 @@ Source21: 50-kvm-s390x.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
 Source22: 95-kvm-ppc64-memlock.conf
 
+# Fix qxl memslot_get_virt crashes (bz #1565354)
+Patch0001: 0001-qxl-fix-local-renderer-crash.patch
+
 # documentation deps
 BuildRequires: texinfo
 # For /usr/bin/pod2man
@@ -1663,6 +1666,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Tue Jun 05 2018 Cole Robinson <crobinso@redhat.com> - 2:2.12.0-2
+- Fix qxl memslot_get_virt crashes (bz #1565354)
+
 * Mon Apr 30 2018 Cole Robinson <crobinso@redhat.com> - 2:2.12.0-1
 - Update to qemu-2.12.0 GA