From: Haotian Jiang <[email protected]> ivshmem_exit() frees s->peers and s->msi_vectors but does not clear the chardev handlers registered in ivshmem_common_realize(). Those handlers are only removed later in object_finalize() via release_chr, which runs after ivshmem_exit().
Between exit and finalize, ivshmem_read() can fire on pending chardev data and process_msg_connect() dereferences the freed s->peers. Additionally, s->peers, s->nb_peers, and s->msi_vectors are not zeroed after free, leaving dangling pointers that make the UAF code paths reachable. Fix by clearing chardev handlers at the beginning of ivshmem_exit(), before any resources they access are freed, and nullifying freed pointers. Cc: [email protected] Fixes: f64a078d45a ("ivshmem: fix pci_ivshmem_exit()") Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594 Reported-by: Haotian Jiang <[email protected]> Signed-off-by: Haotian Jiang <[email protected]> Message-ID: <[email protected]> Signed-off-by: Philippe Mathieu-Daudé <[email protected]> (cherry picked from commit 5157ceb10ca83d1c257ff84368458153a10a2f23) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c index 900d523334c..3f7ad4b633c 100644 --- a/hw/misc/ivshmem-pci.c +++ b/hw/misc/ivshmem-pci.c @@ -920,6 +920,9 @@ static void ivshmem_exit(PCIDevice *dev) IVShmemState *s = IVSHMEM_COMMON(dev); int i; + qemu_chr_fe_set_handlers(&s->server_chr, + NULL, NULL, NULL, NULL, NULL, NULL, true); + migrate_del_blocker(&s->migration_blocker); if (memory_region_is_mapped(s->ivshmem_bar2)) { @@ -948,6 +951,8 @@ static void ivshmem_exit(PCIDevice *dev) close_peer_eventfds(s, i); } g_free(s->peers); + s->peers = NULL; + s->nb_peers = 0; } if (ivshmem_has_feature(s, IVSHMEM_MSI)) { @@ -955,6 +960,7 @@ static void ivshmem_exit(PCIDevice *dev) } g_free(s->msi_vectors); + s->msi_vectors = NULL; } static int ivshmem_pre_load(void *opaque) -- 2.47.3
