Commit eb3f7fe382 for qemu.org

commit eb3f7fe382babbab44419603e81da56abb91d11a
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Tue Aug 18 16:23:54 2026 +0200

    serial: clear transmit retry callback on unrealize

    The GSource is removed when resetting but remains active (and can
    cause use-after-free) on hot-unplug.  Remove it before the character
    device is disconnected.

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4125

    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/hw/char/serial.c b/hw/char/serial.c
index 0729cd2ce9..4339562ab0 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -936,6 +936,7 @@ static void serial_unrealize(DeviceState *dev)
 {
     SerialState *s = SERIAL(dev);

+    g_clear_handle_id(&s->watch_tag, g_source_remove);
     qemu_chr_fe_deinit(&s->chr, false);

     timer_free(s->modem_status_poll);