@samitouri / QOSamiQemu / commits / 5157ceb10c

hw/misc/ivshmem: clear chardev handlers before freeing peers

ivshmem_exit() frees s->peers and s->msi_vectors but does not clear the chardev handlers registered in ivshmem_common_realize(). Those handlers are only removed later in object_finalize() via release_chr, which runs after ivshmem_exit(). Between exit and finalize, ivshmem_read() can fire on pending chardev data and process_msg_connect() dereferences the freed s->peers. Additionally, s->peers, s->nb_peers, and s->msi_vectors are not zeroed after free, leaving dangling pointers that make the UAF code paths reachable. Fix by clearing chardev handlers at the beginning of ivshmem_exit(), before any resources they access are freed, and nullifying freed pointers. Cc: qemu-stable@nongnu.org Fixes: f64a078d45a ("ivshmem: fix pci_ivshmem_exit()") Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594 Reported-by: Haotian Jiang <sundayjiang@tencent.com> Signed-off-by: Haotian Jiang <sundayjiang@tencent.com> Message-ID: <tencent_3105EC28797360A155078F53@qq.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Haotian Jiang committed Jun 29, 2026 at 10:59 UTC 5157ceb10ca83d1c257ff84368458153a10a2f23

1 file changed +6

hw/misc/ivshmem-pci.c

@@ -938,6 +938,9 @@ static void ivshmem_exit(PCIDevice *dev)

938 IVShmemState *s = IVSHMEM_COMMON(dev);

939 int i;

940

941 + qemu_chr_fe_set_handlers(&s->server_chr,

942 + NULL, NULL, NULL, NULL, NULL, NULL, true);

943 +

944 migrate_del_blocker(&s->migration_blocker);

945

946 if (memory_region_is_mapped(s->ivshmem_bar2)) {

@@ -966,6 +969,8 @@ static void ivshmem_exit(PCIDevice *dev)

969 close_peer_eventfds(s, i);

970 }

971 g_free(s->peers);

972 + s->peers = NULL;

973 + s->nb_peers = 0;

974 }

975

976 if (ivshmem_has_feature(s, IVSHMEM_MSI)) {

@@ -973,6 +978,7 @@ static void ivshmem_exit(PCIDevice *dev)

978 }

979

980 g_free(s->msi_vectors);

981 + s->msi_vectors = NULL;

982 }

983

984 static int ivshmem_pre_load(void *opaque)