From dc5d5800f8c69a4a34eda4b1878de2df6a02c4a3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Thu, 23 Apr 2026 00:06:11 +0400 Subject: [PATCH] ui/console: remove console from global list on finalization MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit removes the QemuConsole from the global "consoles" list when it is finalized, fixing use-after-free on throw-away objects. Reproducer: QMP command qom-list-properties with typename "qemu-text-console", "qemu-fixed-text-console" or "qemu-graphic-console". The assertions added ensure that `dcls`, `gl_block`, and the `dump_queue` are empty before removal, confirming the console is in a clean state. This is left to handle correctly in a future series for hot-unplug case. Reported-by: Markus Armbruster Signed-off-by: Marc-André Lureau --- ui/console.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ui/console.c b/ui/console.c index 6f6330d61f..eaa4108674 100644 --- a/ui/console.c +++ b/ui/console.c @@ -392,10 +392,13 @@ qemu_console_finalize(Object *obj) { QemuConsole *c = QEMU_CONSOLE(obj); - /* TODO: check this code path, and unregister from consoles */ + /* TODO: fix hot-unplug support of consoles */ + assert(c->gl_block == 0); + assert(qemu_co_queue_empty(&c->dump_queue)); g_clear_pointer(&c->surface, qemu_free_displaysurface); g_clear_pointer(&c->gl_unblock_timer, timer_free); g_clear_pointer(&c->ui_timer, timer_free); + QTAILQ_REMOVE(&consoles, c, next); } static void