lsi53c895a: keep a reference to the device while SCRIPTS execute
SCRIPTS execution can trigger PCI device unplug and consequently a use-after-free after the unplug returns. Avoid this by keeping the device alive. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3090 Cc: qemu-stable@nongnu.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini committed
Mar 27, 2026 at 17:37 UTC
4862d2c95104d9fd0430cc003c205094f8ada1f9
1 file changed
+3
hw/scsi/lsi53c895a.c
+3
@@ -1163,6 +1163,7 @@ static void lsi_execute_script(LSIState *s)
1163
s->waiting = LSI_NOWAIT;
1164
}
1165
1166
+ object_ref(s);
1167
reentrancy_level++;
1168
1169
s->istat1 |= LSI_ISTAT1_SRUN;
@@ -1182,6 +1183,7 @@ again:
1183
s->waiting = LSI_WAIT_SCRIPTS;
1184
lsi_scripts_timer_start(s);
1185
reentrancy_level--;
1186
+ object_unref(s);
1187
return;
1188
}
1189
insn = read_dword(s, s->dsp);
@@ -1630,6 +1632,7 @@ again:
1632
trace_lsi_execute_script_stop();
1633
1634
reentrancy_level--;
1635
+ object_unref(s);
1636
}
1637
1638
static uint8_t lsi_reg_readb(LSIState *s, int offset)