From: Haotian Jiang <sundayjiang@tencent.com>

Date: Mon, 29 Jun 2026 10:50:21 +0800

Subject: [PATCH] hw/misc/ivshmem: clear chardev handlers before freeing peers

ivshmem_exit() frees s->peers and s->msi_vectors but does not clear

the chardev handlers registered in ivshmem_common_realize().  Those

handlers are only removed later in object_finalize() via release_chr,

which runs after ivshmem_exit().

Between exit and finalize, ivshmem_read() can fire on pending chardev

data and process_msg_connect() dereferences the freed s->peers.

Additionally, s->peers, s->nb_peers, and s->msi_vectors are not

zeroed after free, leaving dangling pointers that make the UAF code

paths reachable.

Fix by clearing chardev handlers at the beginning of ivshmem_exit(),

before any resources they access are freed, and nullifying freed

pointers.

Fixes: f64a078d45a ("ivshmem: fix pci_ivshmem_exit()")

Link: https://gitlab.com/qemu-project/qemu/-/work_items/3594

Reported-by: Haotian Jiang <sundayjiang@tencent.com>

Cc: qemu-stable@nongnu.org

Signed-off-by: Haotian Jiang <sundayjiang@tencent.com>

---

 hw/misc/ivshmem-pci.c | 6 ++++++

 1 file changed, 6 insertions(+)

diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c

index c987eebb98..ce0de5271e 100644

--- a/hw/misc/ivshmem-pci.c

+++ b/hw/misc/ivshmem-pci.c

@@ -938,6 +938,9 @@ static void ivshmem_exit(PCIDevice *dev)

     IVShmemState *s = IVSHMEM_COMMON(dev);

     int i;

 

+    qemu_chr_fe_set_handlers(&s->server_chr, NULL, NULL, NULL, NULL,

+                             NULL, NULL, true);

+

     migrate_del_blocker(&s->migration_blocker);

 

     if (memory_region_is_mapped(s->ivshmem_bar2)) {

@@ -966,6 +969,8 @@ static void ivshmem_exit(PCIDevice *dev)

             close_peer_eventfds(s, i);

         }

         g_free(s->peers);

+        s->peers = NULL;

+        s->nb_peers = 0;

     }

 

     if (ivshmem_has_feature(s, IVSHMEM_MSI)) {

@@ -973,6 +978,7 @@ static void ivshmem_exit(PCIDevice *dev)

     }

 

     g_free(s->msi_vectors);

+    s->msi_vectors = NULL;

 }

 

 static int ivshmem_pre_load(void *opaque)

--

2.34.1