Commit 5157ceb10c for qemu.org

commit 5157ceb10ca83d1c257ff84368458153a10a2f23
Author: Haotian Jiang <sundayjiang@tencent.com>
Date:   Mon Jun 29 10:59:03 2026 +0800

    hw/misc/ivshmem: clear chardev handlers before freeing peers

    ivshmem_exit() frees s->peers and s->msi_vectors but does not clear
    the chardev handlers registered in ivshmem_common_realize(). Those
    handlers are only removed later in object_finalize() via release_chr,
    which runs after ivshmem_exit().

    Between exit and finalize, ivshmem_read() can fire on pending chardev
    data and process_msg_connect() dereferences the freed s->peers.
    Additionally, s->peers, s->nb_peers, and s->msi_vectors are not
    zeroed after free, leaving dangling pointers that make the UAF code
    paths reachable.

    Fix by clearing chardev handlers at the beginning of ivshmem_exit(),
    before any resources they access are freed, and nullifying freed
    pointers.

    Cc: qemu-stable@nongnu.org
    Fixes: f64a078d45a ("ivshmem: fix pci_ivshmem_exit()")
    Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594
    Reported-by: Haotian Jiang <sundayjiang@tencent.com>
    Signed-off-by: Haotian Jiang <sundayjiang@tencent.com>
    Message-ID: <tencent_3105EC28797360A155078F53@qq.com>
    Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index 536475e9de..372e9dc58d 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -938,6 +938,9 @@ static void ivshmem_exit(PCIDevice *dev)
     IVShmemState *s = IVSHMEM_COMMON(dev);
     int i;

+    qemu_chr_fe_set_handlers(&s->server_chr,
+                             NULL, NULL, NULL, NULL, NULL, NULL, true);
+
     migrate_del_blocker(&s->migration_blocker);

     if (memory_region_is_mapped(s->ivshmem_bar2)) {
@@ -966,6 +969,8 @@ static void ivshmem_exit(PCIDevice *dev)
             close_peer_eventfds(s, i);
         }
         g_free(s->peers);
+        s->peers = NULL;
+        s->nb_peers = 0;
     }

     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
@@ -973,6 +978,7 @@ static void ivshmem_exit(PCIDevice *dev)
     }

     g_free(s->msi_vectors);
+    s->msi_vectors = NULL;
 }

 static int ivshmem_pre_load(void *opaque)