Commit 919711cab2 for qemu.org

commit 919711cab29776f12209b375a4db251007c6d96e
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date:   Sun Oct 4 14:23:37 2026 +0400

    chardev/char: fix use-after-free on mux creation failure

    When mux creation fails, object_unparent() drops the last reference
    on the base chardev, but 'base' was left dangling. The 'out' label
    then passes it to qemu_chardev_set_replay(), causing a
    use-after-free.

    Set base to NULL after unparent so the replay path is skipped.

    Reported-by: Hui Peng <benquike@gmail.com>
    Fixes: 4c193bb129da ("chardev: set record/replay on the base device of a muxed device")
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Message-ID: <20261004-issue-4560-v1-23-ccbef537cbeb@redhat.com>

diff --git a/chardev/char.c b/chardev/char.c
index fe513ae962..972550ba1f 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -759,6 +759,7 @@ static Chardev *do_qemu_chr_new_from_opts(QemuOpts *opts, GMainContext *context,
         mux = qemu_chardev_new(id, TYPE_CHARDEV_MUX, backend, context, errp);
         if (mux == NULL) {
             object_unparent(OBJECT(chr));
+            base = NULL;
             chr = NULL;
             goto out;
         }