starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-07-08 17:46:10 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

ui/console: remove console from global list on finalization

Browse Source 
This commit removes the QemuConsole from the global "consoles" list when
it is finalized, fixing use-after-free on throw-away objects.

Reproducer: QMP command qom-list-properties with typename
"qemu-text-console", "qemu-fixed-text-console" or
"qemu-graphic-console".

The assertions added ensure that `dcls`, `gl_block`, and the
`dump_queue` are empty before removal, confirming the console is in a
clean state. This is left to handle correctly in a future series for
hot-unplug case.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
This commit is contained in:
Marc-André Lureau
2026-04-23 00:06:11 +04:00
parent 010a30d8a4
commit dc5d5800f8
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ui/console.c
View File

@@ -392,10 +392,13 @@ qemu_console_finalize(Object *obj)
{
QemuConsole *c = QEMU_CONSOLE(obj);
/* TODO: check this code path, and unregister from consoles */
/* TODO: fix hot-unplug support of consoles */
assert(c->gl_block == 0);
assert(qemu_co_queue_empty(&c->dump_queue));
g_clear_pointer(&c->surface, qemu_free_displaysurface);
g_clear_pointer(&c->gl_unblock_timer, timer_free);
g_clear_pointer(&c->ui_timer, timer_free);
QTAILQ_REMOVE(&consoles, c, next);
}
static void