[Stable-10.0.13 v3 143/166] serial: clear transmit retry callback on unrealize

[Michael Tokarev]

From: Paolo Bonzini <pbonz...@redhat.com>

The GSource is removed when resetting but remains active (and can
cause use-after-free) on hot-unplug.  Remove it before the character
device is disconnected.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4125

Reviewed-by: Marc-André Lureau <marcandre.lur...@redhat.com>
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
(cherry picked from commit eb3f7fe382babbab44419603e81da56abb91d11a)
Signed-off-by: Michael Tokarev <m...@tls.msk.ru>

diff --git a/hw/char/serial.c b/hw/char/serial.c
index 70044e14a0f..350cd56cd87 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -939,6 +939,7 @@ static void serial_unrealize(DeviceState *dev)
 {
     SerialState *s = SERIAL(dev);
 
+    g_clear_handle_id(&s->watch_tag, g_source_remove);
     qemu_chr_fe_deinit(&s->chr, false);
 
     timer_free(s->modem_status_poll);
-- 
2.47.3