friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/misc/ivshmem: clear chardev handlers before freeing peers

Browse Source 
ivshmem_exit() frees s->peers and s->msi_vectors but does not clear
the chardev handlers registered in ivshmem_common_realize(). Those
handlers are only removed later in object_finalize() via release_chr,
which runs after ivshmem_exit().

Between exit and finalize, ivshmem_read() can fire on pending chardev
data and process_msg_connect() dereferences the freed s->peers.
Additionally, s->peers, s->nb_peers, and s->msi_vectors are not
zeroed after free, leaving dangling pointers that make the UAF code
paths reachable.

Fix by clearing chardev handlers at the beginning of ivshmem_exit(),
before any resources they access are freed, and nullifying freed
pointers.

Cc: qemu-stable@nongnu.org
Fixes: f64a078d45 ("ivshmem: fix pci_ivshmem_exit()")
Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594
Reported-by: Haotian Jiang <sundayjiang@tencent.com>
Signed-off-by: Haotian Jiang <sundayjiang@tencent.com>
Message-ID: <tencent_3105EC28797360A155078F53@qq.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
This commit is contained in:
Haotian Jiang
2026-06-29 10:59:03 +08:00
committed by Philippe Mathieu-Daudé
parent 506fa577db
commit 5157ceb10c
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
hw/misc/ivshmem-pci.c
View File

@@ -938,6 +938,9 @@ static void ivshmem_exit(PCIDevice *dev)
IVShmemState *s = IVSHMEM_COMMON(dev);
int i;
qemu_chr_fe_set_handlers(&s->server_chr,
NULL, NULL, NULL, NULL, NULL, NULL, true);
migrate_del_blocker(&s->migration_blocker);
if (memory_region_is_mapped(s->ivshmem_bar2)) {
@@ -966,6 +969,8 @@ static void ivshmem_exit(PCIDevice *dev)
close_peer_eventfds(s, i);
}
g_free(s->peers);
s->peers = NULL;
s->nb_peers = 0;
}
if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
@@ -973,6 +978,7 @@ static void ivshmem_exit(PCIDevice *dev)
}
g_free(s->msi_vectors);
s->msi_vectors = NULL;
}
static int ivshmem_pre_load(void *opaque)