serial: clear transmit retry callback on unrealize
The GSource is removed when resetting but remains active (and can cause use-after-free) on hot-unplug. Remove it before the character device is disconnected. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4125 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini committed
Aug 18, 2026 at 16:23 UTC
eb3f7fe382babbab44419603e81da56abb91d11a
1 file changed
+1
hw/char/serial.c
+1
@@ -936,6 +936,7 @@ static void serial_unrealize(DeviceState *dev)
936
{
937
SerialState *s = SERIAL(dev);
938
939
+ g_clear_handle_id(&s->watch_tag, g_source_remove);
940
qemu_chr_fe_deinit(&s->chr, false);
941
942
timer_free(s->modem_status_poll);