Re: [PATCH] serial: clear transmit retry callback on unrealize

On 8/18/26 17:28, Paolo Bonzini wrote:
> The GSource is removed when resetting but remains active (and can
> cause use-after-free) on hot-unplug.  Remove it before the character
> device is disconnected.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4125
> Signed-off-by: Paolo Bonzini <[email protected]>

I'm picking this up for qemu-stable.
Please let me know if I shouldn't.

Thanks,

/mjt

> diff --git a/hw/char/serial.c b/hw/char/serial.c
> index 0729cd2ce9d..4339562ab00 100644
> --- a/hw/char/serial.c
> +++ b/hw/char/serial.c
> @@ -936,6 +936,7 @@ static void serial_unrealize(DeviceState *dev)
>   {
>       SerialState *s = SERIAL(dev);
>   
> +    g_clear_handle_id(&s->watch_tag, g_source_remove);
>       qemu_chr_fe_deinit(&s->chr, false);
>   
>       timer_free(s->modem_status_poll);