xemu/hw/char
Ladi Prosek f811f97040 virtio-serial-bus: Unset hotplug handler when unrealize
Virtio serial device controls the lifetime of virtio-serial-bus and
virtio-serial-bus links back to the device via its hotplug-handler
property. This extra ref-count prevents the device from getting
finalized, leaving the VirtIODevice memory listener registered and
leading to use-after-free later on.

This patch addresses the same issue as Fam Zheng's
"virtio-scsi: Unset hotplug handler when unrealize"
only for a different virtio device.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
2017-06-02 18:57:16 +03:00
..
Makefile.objs s390x/3270: Mark non-migratable and enable the device 2017-05-04 10:34:37 +02:00
bcm2835_aux.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
cadence_uart.c cadence_uart: Check if receiver timeout counter is disabled 2016-12-27 14:59:23 +00:00
debugcon.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
digic-uart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
escc.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
etraxfs_ser.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
exynos4210_uart.c hw/char/exynos4210_uart: Constify static array and few arguments 2017-04-20 17:39:17 +01:00
grlib_apbuart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
imx_serial.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
ipoctal232.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
lm32_juart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
lm32_uart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
mcf_uart.c hw/char/mcf_uart: QOMify the ColdFire UART 2017-02-16 14:06:56 +01:00
milkymist-uart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
omap_uart.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
parallel.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
pl011.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
sclpconsole-lm.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
sclpconsole.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
serial-isa.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
serial-pci.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
serial.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
sh_serial.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
spapr_vty.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
stm32f2xx_usart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
terminal3270.c s390x/3270: Mark non-migratable and enable the device 2017-05-04 10:34:37 +02:00
trace-events hw/char/pl011: Add trace events 2016-10-17 19:32:44 +01:00
virtio-console.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
virtio-serial-bus.c virtio-serial-bus: Unset hotplug handler when unrealize 2017-06-02 18:57:16 +03:00
xen_console.c xen: Rename xen_be_send_notify 2016-10-28 17:54:21 -07:00
xilinx_uartlite.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00