qemu-irix/hw/char
Ladi Prosek 11bac2f941 virtio-serial-bus: Unset hotplug handler when unrealize
Virtio serial device controls the lifetime of virtio-serial-bus and
virtio-serial-bus links back to the device via its hotplug-handler
property. This extra ref-count prevents the device from getting
finalized, leaving the VirtIODevice memory listener registered and
leading to use-after-free later on.

This patch addresses the same issue as Fam Zheng's
"virtio-scsi: Unset hotplug handler when unrealize"
only for a different virtio device.

Cc: qemu-stable@nongnu.org
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Fam Zheng <famz@redhat.com>
(cherry picked from commit f811f97040)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
2017-08-03 16:01:28 -05:00
..
Makefile.objs xen: do not build backends for targets that do not support xen 2017-03-19 11:12:12 +01:00
bcm2835_aux.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
cadence_uart.c cadence_uart: Check if receiver timeout counter is disabled 2016-12-27 14:59:23 +00:00
debugcon.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
digic-uart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
escc.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
etraxfs_ser.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
exynos4210_uart.c migration: consolidate VMStateField.start 2017-02-13 17:27:13 +00:00
grlib_apbuart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
imx_serial.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
ipoctal232.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
lm32_juart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
lm32_uart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
mcf_uart.c hw/char/mcf_uart: QOMify the ColdFire UART 2017-02-16 14:06:56 +01:00
milkymist-uart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
omap_uart.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
parallel.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
pl011.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
sclpconsole-lm.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
sclpconsole.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
serial-isa.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
serial-pci.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
serial.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
sh_serial.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
spapr_vty.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
stm32f2xx_usart.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00
trace-events hw/char/pl011: Add trace events 2016-10-17 19:32:44 +01:00
virtio-console.c char: rename CharDriverState Chardev 2017-01-27 18:07:59 +01:00
virtio-serial-bus.c virtio-serial-bus: Unset hotplug handler when unrealize 2017-08-03 16:01:28 -05:00
xen_console.c xen: Rename xen_be_send_notify 2016-10-28 17:54:21 -07:00
xilinx_uartlite.c char: remove explicit_fe_open, use a set_handlers argument 2016-10-24 15:46:10 +02:00