From nobody Sat Sep 26 20:02:31 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1788901933; cv=none; d=zohomail.com; s=zohoarc; b=FJrm7p+yfJCRhxtovciJTEnsGqJ9Og81nqO1oH2uUqtREWR8EFD5SQqV3InUhznjwYBjBTrPrmcK16RN3IroP2SF3cxfLNJ4FZZBuXjIdfyhHKePdVorYIl5m9EsoEwwBljDB/IP2h4wf1fIwko1PFEeOsZFzCp+lklWQuPBmMM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1788901933; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=D/gIcq8Q0xK90fKE6Ee6Tik/rd5t0Ekycx7jEkKYKP4=; b=ebiZsSON2MHp+uF8e8rMRnAJpPklYgG5vofFirkRzBwvcjzMLEQjwdU8eZDl39ti2ZGdMuf7VDuHOzfO5fIbETzbtad6JD+Me171NQQasjy5Ht2c2Mjx7gk6H/x9izW9Il/kI+dNhGW5I2UzEBsm36sTsnUTD4fbgM7Vj/v/Ops= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1788901933150652.2782506147538; Tue, 8 Sep 2026 14:12:13 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x436V-0003Lr-V8; Tue, 08 Sep 2026 17:11:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x436P-0003LQ-EZ for qemu-devel@nongnu.org; Tue, 08 Sep 2026 17:11:38 -0400 Received: from sonata.ens-lyon.org ([140.77.166.138]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x436N-0001M6-H3 for qemu-devel@nongnu.org; Tue, 08 Sep 2026 17:11:37 -0400 Received: from localhost (localhost [127.0.0.1]) by sonata.ens-lyon.org (Postfix) with ESMTP id E94ECA1CE7; Tue, 8 Sep 2026 23:11:30 +0200 (CEST) Received: from sonata.ens-lyon.org ([127.0.0.1]) by localhost (sonata.ens-lyon.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jsd_dMMzQzSs; Tue, 8 Sep 2026 23:11:30 +0200 (CEST) Received: from end (aamiens-653-1-40-48.w83-192.abo.wanadoo.fr [83.192.199.48]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by sonata.ens-lyon.org (Postfix) with ESMTPSA id 4515DA1C43; Tue, 8 Sep 2026 23:11:29 +0200 (CEST) Received: from samy by end with local (Exim 4.100) (envelope-from ) id 1x436G-00000001btj-3O35; Tue, 08 Sep 2026 23:11:28 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ens-lyon.org; s=dkim; t=1788901890; bh=QBFMfNP5LYG0Z7Yhy6tmRXxmOozuBAzbbB9jh5KLdMc=; h=From:To:Cc:Subject:Date:From; b=QJ4IOudB5FD4i3EHRkzCS+c/B3K1P39BfnO9ewGWl7LkdIf/7IgwwtpMEg5ZpXwYZ QSZIzXvefFpj6b3K7NeH6y2b8zM0ZRPSXkgQQD6cNQgpwVAwLeO+Ui9ntJWhthdX7c gcPUn258lUUHPKnqucd0ppMNqi15Z7wk1L9BrOwSM5LZkvo28l2nUyxDZYDp5U1hMI +fijIdKoZnOwj20C8QInGeKldoRa4N8BpsoRuKM9vOAMP3F/xLGLXFOI3gJUd/CHvF SOEW1SEjUh4n1CmE40RbHKtVATuywBgNeYN/2+fcb0T9v3l6V/90/XUoDF0OCw9Zh1 b3RovGhiA/0dw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ens-lyon.org; s=dkim; t=1788901890; bh=QBFMfNP5LYG0Z7Yhy6tmRXxmOozuBAzbbB9jh5KLdMc=; h=From:To:Cc:Subject:Date:From; b=QJ4IOudB5FD4i3EHRkzCS+c/B3K1P39BfnO9ewGWl7LkdIf/7IgwwtpMEg5ZpXwYZ QSZIzXvefFpj6b3K7NeH6y2b8zM0ZRPSXkgQQD6cNQgpwVAwLeO+Ui9ntJWhthdX7c gcPUn258lUUHPKnqucd0ppMNqi15Z7wk1L9BrOwSM5LZkvo28l2nUyxDZYDp5U1hMI +fijIdKoZnOwj20C8QInGeKldoRa4N8BpsoRuKM9vOAMP3F/xLGLXFOI3gJUd/CHvF SOEW1SEjUh4n1CmE40RbHKtVATuywBgNeYN/2+fcb0T9v3l6V/90/XUoDF0OCw9Zh1 b3RovGhiA/0dw== From: Samuel Thibault To: qemu-devel@nongnu.org Cc: Hongyan Xu , Samuel Thibault Subject: [PATCH] chardev/baum: unregister the brlapi fd handler on finalize Date: Tue, 8 Sep 2026 23:11:26 +0200 Message-ID: <20260908211126.383996-1-samuel.thibault@ens-lyon.org> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=140.77.166.138; envelope-from=SRS0=gK2s=HA=ens-lyon.org=samuel.thibault@bounce.ens-lyon.org; helo=sonata.ens-lyon.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @ens-lyon.org) X-ZM-MESSAGEID: 1788901938613158500 Content-Type: text/plain; charset="utf-8" From: Hongyan Xu baum_chr_open() registers baum->brlapi_fd with the main loop through a raw qemu_set_fd_handler() call. The chardev base class does not know about this handler, and char_braille_finalize() only closes the brlapi connection and frees the handle; it never removes the fd handler. When the chardev is removed at runtime (QMP chardev-remove / object_unparent), BaumChardev is finalized and freed while the main loop still holds an fd handler whose opaque points to the freed object. The next time brlapi_fd becomes readable (or the connection drops) the loop calls baum_chr_read() with a dangling opaque, dereferencing freed memory -> host use-after-free. Unregister the handler in char_braille_finalize() before tearing the connection down, using the same descriptor that baum_chr_open() registered, and NULL the handle afterwards as a belt-and-braces guard. Only do so while baum->brlapi is valid: baum_chr_open() sets baum->brlapi_fd from brlapi__openConnection(), which is BRLAPI_INVALID_FILE_DESCRIPTOR on failure, and that error path already g_free()s the handle and returns before any handler is installed. Signed-off-by: Hongyan Xu Signed-off-by: Samuel Thibault Message-ID: <20260904033055.413-1-getshell@seu.edu.cn> --- chardev/baum.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/chardev/baum.c b/chardev/baum.c index ac1e535ba8..166d6f2f09 100644 --- a/chardev/baum.c +++ b/chardev/baum.c @@ -659,6 +659,7 @@ static void baum_chr_read(void *opaque) } if (ret =3D=3D -1 && (brlapi_errno !=3D BRLAPI_ERROR_LIBCERR || errno = !=3D EINTR)) { brlapi_perror("baum: brlapi_readKey"); + qemu_set_fd_handler(baum->brlapi_fd, NULL, NULL, NULL); brlapi__closeConnection(baum->brlapi); g_free(baum->brlapi); baum->brlapi =3D NULL; @@ -671,8 +672,16 @@ static void char_braille_finalize(Object *obj) =20 timer_free(baum->cellCount_timer); if (baum->brlapi) { + /* + * baum_chr_open() registered brlapi_fd with the main loop via + * qemu_set_fd_handler(); unregister it before tearing the + * connection down so a later chardev-remove cannot dispatch + * baum_chr_read() with a dangling opaque. + */ + qemu_set_fd_handler(baum->brlapi_fd, NULL, NULL, NULL); brlapi__closeConnection(baum->brlapi); g_free(baum->brlapi); + baum->brlapi =3D NULL; } } =20 --=20 2.53.0