When mux creation fails, object_unparent() drops the last reference on the base chardev, but 'base' was left dangling. The 'out' label then passes it to qemu_chardev_set_replay(), causing a use-after-free.
Set base to NULL after unparent so the replay path is skipped. Reported-by: Hui Peng <[email protected]> Fixes: 4c193bb129da ("chardev: set record/replay on the base device of a muxed device") Signed-off-by: Marc-André Lureau <[email protected]> Message-ID: <[email protected]> --- chardev/char.c | 1 + 1 file changed, 1 insertion(+) diff --git a/chardev/char.c b/chardev/char.c index fe513ae9621a..972550ba1f80 100644 --- a/chardev/char.c +++ b/chardev/char.c @@ -759,6 +759,7 @@ static Chardev *do_qemu_chr_new_from_opts(QemuOpts *opts, GMainContext *context, mux = qemu_chardev_new(id, TYPE_CHARDEV_MUX, backend, context, errp); if (mux == NULL) { object_unparent(OBJECT(chr)); + base = NULL; chr = NULL; goto out; } -- 2.56.0.116.g6de20f6092dc
