1. Patchew
  2. QEMU
  3. View series

[PATCH] hw/misc/ivshmem: clear chardev handlers before freeing peers

sundayjiang(蒋浩天) posted 1 patch 3 weeks, 6 days ago
Failed in applying to current master (apply log)
 hw/misc/ivshmem-pci.c | 6 ++++++
[PATCH] hw/misc/ivshmem: clear chardev handlers before freeing peers
Posted by sundayjiang(蒋浩天) 3 weeks, 6 days ago 
From 2a7fa17cd21d0a5c1ddf0f13f5c6b39375052aef Mon Sep 17 00:00:00 2001From: Haotian Jiang <sundayjiang@tencent.com&gt;
Date: Mon, 29 Jun 2026 10:50:21 +0800
Subject: [PATCH] hw/misc/ivshmem: clear chardev handlers before freeing peers


ivshmem_exit() frees s-&gt;peers and s-&gt;msi_vectors but does not clear
the chardev handlers registered in ivshmem_common_realize(). &nbsp;Those
handlers are only removed later in object_finalize() via release_chr,
which runs after ivshmem_exit().


Between exit and finalize, ivshmem_read() can fire on pending chardev
data and process_msg_connect() dereferences the freed s-&gt;peers.
Additionally, s-&gt;peers, s-&gt;nb_peers, and s-&gt;msi_vectors are not
zeroed after free, leaving dangling pointers that make the UAF code
paths reachable.


Fix by clearing chardev handlers at the beginning of ivshmem_exit(),
before any resources they access are freed, and nullifying freed
pointers.


Fixes: f64a078d45a ("ivshmem: fix pci_ivshmem_exit()")
Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594
Reported-by: Haotian Jiang <sundayjiang@tencent.com&gt;
Cc: qemu-stable@nongnu.org
Signed-off-by: Haotian Jiang <sundayjiang@tencent.com&gt;
---
&nbsp;hw/misc/ivshmem-pci.c | 6 ++++++
&nbsp;1 file changed, 6 insertions(+)


diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index c987eebb98..ce0de5271e 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -938,6 +938,9 @@ static void ivshmem_exit(PCIDevice *dev)
&nbsp; &nbsp; &nbsp;IVShmemState *s = IVSHMEM_COMMON(dev);
&nbsp; &nbsp; &nbsp;int i;
&nbsp;
+ &nbsp; &nbsp;qemu_chr_fe_set_handlers(&amp;s-&gt;server_chr, NULL, NULL, NULL, NULL,
+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NULL, NULL, true);
+
&nbsp; &nbsp; &nbsp;migrate_del_blocker(&amp;s-&gt;migration_blocker);
&nbsp;
&nbsp; &nbsp; &nbsp;if (memory_region_is_mapped(s-&gt;ivshmem_bar2)) {
@@ -966,6 +969,8 @@ static void ivshmem_exit(PCIDevice *dev)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;close_peer_eventfds(s, i);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;g_free(s-&gt;peers);
+ &nbsp; &nbsp; &nbsp; &nbsp;s-&gt;peers = NULL;
+ &nbsp; &nbsp; &nbsp; &nbsp;s-&gt;nb_peers = 0;
&nbsp; &nbsp; &nbsp;}
&nbsp;
&nbsp; &nbsp; &nbsp;if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
@@ -973,6 +978,7 @@ static void ivshmem_exit(PCIDevice *dev)
&nbsp; &nbsp; &nbsp;}
&nbsp;
&nbsp; &nbsp; &nbsp;g_free(s-&gt;msi_vectors);
+ &nbsp; &nbsp;s-&gt;msi_vectors = NULL;
&nbsp;}
&nbsp;
&nbsp;static int ivshmem_pre_load(void *opaque)
-- 
2.34.1
Re: [PATCH] hw/misc/ivshmem: clear chardev handlers before freeing peers
Posted by Philippe Mathieu-Daudé 1 week, 6 days ago 
Cc'ing Gustavo

On 29/6/26 04:59, sundayjiang(è浩天) wrote:
>  From 2a7fa17cd21d0a5c1ddf0f13f5c6b39375052aef Mon Sep 17 00:00:00 2001From: Haotian Jiang <sundayjiang@tencent.com&gt;
> Date: Mon, 29 Jun 2026 10:50:21 +0800
> Subject: [PATCH] hw/misc/ivshmem: clear chardev handlers before freeing peers
> 
> 
> ivshmem_exit() frees s-&gt;peers and s-&gt;msi_vectors but does not clear
> the chardev handlers registered in ivshmem_common_realize(). &nbsp;Those
> handlers are only removed later in object_finalize() via release_chr,
> which runs after ivshmem_exit().
> 
> 
> Between exit and finalize, ivshmem_read() can fire on pending chardev
> data and process_msg_connect() dereferences the freed s-&gt;peers.
> Additionally, s-&gt;peers, s-&gt;nb_peers, and s-&gt;msi_vectors are not
> zeroed after free, leaving dangling pointers that make the UAF code
> paths reachable.
> 
> 
> Fix by clearing chardev handlers at the beginning of ivshmem_exit(),
> before any resources they access are freed, and nullifying freed
> pointers.
> 
> 
> Fixes: f64a078d45a ("ivshmem: fix pci_ivshmem_exit()")
> Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594
> Reported-by: Haotian Jiang <sundayjiang@tencent.com&gt;
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Haotian Jiang <sundayjiang@tencent.com&gt;
> ---
> &nbsp;hw/misc/ivshmem-pci.c | 6 ++++++
> &nbsp;1 file changed, 6 insertions(+)
> 
> 
> diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
> index c987eebb98..ce0de5271e 100644
> --- a/hw/misc/ivshmem-pci.c
> +++ b/hw/misc/ivshmem-pci.c
> @@ -938,6 +938,9 @@ static void ivshmem_exit(PCIDevice *dev)
> &nbsp; &nbsp; &nbsp;IVShmemState *s = IVSHMEM_COMMON(dev);
> &nbsp; &nbsp; &nbsp;int i;
> &nbsp;
> + &nbsp; &nbsp;qemu_chr_fe_set_handlers(&amp;s-&gt;server_chr, NULL, NULL, NULL, NULL,
> + &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; NULL, NULL, true);
> +
> &nbsp; &nbsp; &nbsp;migrate_del_blocker(&amp;s-&gt;migration_blocker);
> &nbsp;
> &nbsp; &nbsp; &nbsp;if (memory_region_is_mapped(s-&gt;ivshmem_bar2)) {
> @@ -966,6 +969,8 @@ static void ivshmem_exit(PCIDevice *dev)
> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;close_peer_eventfds(s, i);
> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}
> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;g_free(s-&gt;peers);
> + &nbsp; &nbsp; &nbsp; &nbsp;s-&gt;peers = NULL;
> + &nbsp; &nbsp; &nbsp; &nbsp;s-&gt;nb_peers = 0;
> &nbsp; &nbsp; &nbsp;}
> &nbsp;
> &nbsp; &nbsp; &nbsp;if (ivshmem_has_feature(s, IVSHMEM_MSI)) {
> @@ -973,6 +978,7 @@ static void ivshmem_exit(PCIDevice *dev)
> &nbsp; &nbsp; &nbsp;}
> &nbsp;
> &nbsp; &nbsp; &nbsp;g_free(s-&gt;msi_vectors);
> + &nbsp; &nbsp;s-&gt;msi_vectors = NULL;
> &nbsp;}
> &nbsp;
> &nbsp;static int ivshmem_pre_load(void *opaque)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.