ui/console: remove console from global list on finalization
This commit removes the QemuConsole from the global "consoles" list when it is finalized, fixing use-after-free on throw-away objects. Reproducer: QMP command qom-list-properties with typename "qemu-text-console", "qemu-fixed-text-console" or "qemu-graphic-console". The assertions added ensure that `dcls`, `gl_block`, and the `dump_queue` are empty before removal, confirming the console is in a clean state. This is left to handle correctly in a future series for hot-unplug case. Reported-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Marc-André Lureau committed
Apr 23, 2026 at 00:06 UTC
dc5d5800f8c69a4a34eda4b1878de2df6a02c4a3
1 file changed
+4
-1
ui/console.c
+4
-1
@@ -392,10 +392,13 @@ qemu_console_finalize(Object *obj)
392
{
393
QemuConsole *c = QEMU_CONSOLE(obj);
394
395
- /* TODO: check this code path, and unregister from consoles */
395
+ /* TODO: fix hot-unplug support of consoles */
396
+ assert(c->gl_block == 0);
397
+ assert(qemu_co_queue_empty(&c->dump_queue));
398
g_clear_pointer(&c->surface, qemu_free_displaysurface);
399
g_clear_pointer(&c->gl_unblock_timer, timer_free);
400
g_clear_pointer(&c->ui_timer, timer_free);
401
+ QTAILQ_REMOVE(&consoles, c, next);
402
}
403
404
static void