diff options
| author | Paolo Bonzini <pbonzini@redhat.com> | 2026-08-18 16:23:54 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-08-21 13:00:54 +0300 |
| commit | d1f8bfb5bc3e2eae15235944abb6e55b92e4fe90 (patch) | |
| tree | e95dfdd007e6ba561ba7e9be2ee7f9712f8642fb | |
| parent | 3d59577e1e6ed4824011dcc4573d97ed482f3b93 (diff) | |
| download | qemu-d1f8bfb5bc3e2eae15235944abb6e55b92e4fe90.tar.gz qemu-d1f8bfb5bc3e2eae15235944abb6e55b92e4fe90.zip | |
serial: clear transmit retry callback on unrealize
The GSource is removed when resetting but remains active (and can
cause use-after-free) on hot-unplug. Remove it before the character
device is disconnected.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4125
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit eb3f7fe382babbab44419603e81da56abb91d11a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | hw/char/serial.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/char/serial.c b/hw/char/serial.c index 0f3469a1e8..1174e0e38a 100644 --- a/hw/char/serial.c +++ b/hw/char/serial.c @@ -940,6 +940,7 @@ static void serial_unrealize(DeviceState *dev) { SerialState *s = SERIAL(dev); + g_clear_handle_id(&s->watch_tag, g_source_remove); qemu_chr_fe_deinit(&s->chr, false); timer_free(s->modem_status_poll); |