[PATCH 23/63] chardev/char: fix use-after-free on mux creation failure

[Marc-André Lureau]

When mux creation fails, object_unparent() drops the last reference
on the base chardev, but 'base' was left dangling. The 'out' label
then passes it to qemu_chardev_set_replay(), causing a
use-after-free.

Set base to NULL after unparent so the replay path is skipped.

Reported-by: Pavee Hui <p...@google.com>
Fixes: 4c193bb129da ("chardev: set record/replay on the base device of a muxed 
device")
Signed-off-by: Marc-André Lureau <marcandre.lur...@redhat.com>
---
 chardev/char.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/chardev/char.c b/chardev/char.c
index 9da0911e503c..7daf87f0363e 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -747,6 +747,7 @@ static Chardev *do_qemu_chr_new_from_opts(QemuOpts *opts, 
GMainContext *context,
         mux = qemu_chardev_new(id, TYPE_CHARDEV_MUX, backend, context, errp);
         if (mux == NULL) {
             object_unparent(OBJECT(chr));
+            base = NULL;
             chr = NULL;
             goto out;
         }

-- 
2.56.0.rc0.29.g47ce80527c56