[{"id":3681274,"web_url":"http://patchwork.ozlabs.org/comment/3681274/","msgid":"<87v7dis20c.fsf@pond.sub.org>","list_archive_url":null,"date":"2026-04-23T05:02:11","subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","submitter":{"id":2645,"url":"http://patchwork.ozlabs.org/api/people/2645/","name":"Markus Armbruster","email":"armbru@redhat.com"},"content":"marcandre.lureau@redhat.com writes:\n\n> From: Marc-André Lureau \n>\n> This commit removes the QemuConsole from the global \"consoles\" list when\n> it is finalized.\n>\n> Previously, there was a TODO comment indicating this path needed\n> checking. The assertions added ensure that `dcls`, `gl_block`, and the\n> `dump_queue` are empty before removal, confirming the console is in a\n> clean state.\n>\n> Fix potential use-after-free crashes when a display console is removed.\n>\n> Reported-by: Markus Armbruster \n> Signed-off-by: Marc-André Lureau \n> ---\n> ui/console.c | 5 ++++-\n> 1 file changed, 4 insertions(+), 1 deletion(-)\n>\n> diff --git a/ui/console.c b/ui/console.c\n> index f445db11389..b64e2122f34 100644\n> --- a/ui/console.c\n> +++ b/ui/console.c\n> @@ -394,10 +394,13 @@ qemu_console_finalize(Object *obj)\n> {\n> QemuConsole *c = QEMU_CONSOLE(obj);\n> \n> - /* TODO: check this code path, and unregister from consoles */\n> + assert(c->dcls == 0);\n> + assert(c->gl_block == 0);\n> + assert(qemu_co_queue_empty(&c->dump_queue));\n\nHelp me out: what ensures this?\n\n> g_clear_pointer(&c->surface, qemu_free_displaysurface);\n> g_clear_pointer(&c->gl_unblock_timer, timer_free);\n> g_clear_pointer(&c->ui_timer, timer_free);\n> + QTAILQ_REMOVE(&consoles, c, next);\n\nIs @consoles only accessed from the main thread?\n\n> }\n> \n> static void","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=TLtiwzSr;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1P9m5n9Nz1yD5\n\tfor ; Thu, 23 Apr 2026 15:03:07 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wFmD0-00036f-Ei; Thu, 23 Apr 2026 01:02:40 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wFmCi-00035s-Mp\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 01:02:21 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.129.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wFmCh-0007OK-0I\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 01:02:20 -0400","from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-441-GRUEQKxTOvid9SPFEGabHw-1; Thu,\n 23 Apr 2026 01:02:15 -0400","from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 4A40F195605F\n for ; Thu, 23 Apr 2026 05:02:14 +0000 (UTC)","from blackfin.pond.sub.org (unknown [10.44.22.30])\n by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id 032AA180045E\n for ; Thu, 23 Apr 2026 05:02:13 +0000 (UTC)","by blackfin.pond.sub.org (Postfix, from userid 1000)\n id 49F7221E6A28; Thu, 23 Apr 2026 07:02:11 +0200 (CEST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776920536;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=1yFCd+gBtlVaNXTSSuckob3QlPY5VzhH/HBlQlwUbNA=;\n b=TLtiwzSrRct4k48xsekbadax+IN7DcxHplBZ0A6e3M8A9HTBGLblURGBJp/wpye9maRu/n\n EmwrW/c8VgJHQ6Ds5SfGK9QeK7xHDB8QOtezLhyKPS3lkbIKkJnv+7cJGmXLJWor+2j05w\n RLQ9h+G3y7gn/i+ZqhoOUOeW/0Gad9M=","X-MC-Unique":"GRUEQKxTOvid9SPFEGabHw-1","X-Mimecast-MFC-AGG-ID":"GRUEQKxTOvid9SPFEGabHw_1776920534","From":"Markus Armbruster ","To":"marcandre.lureau@redhat.com","Cc":"qemu-devel@nongnu.org","Subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","In-Reply-To":"<20260422202646.272081-1-marcandre.lureau@redhat.com> (marcandre\n lureau's message of \"Thu, 23 Apr 2026 00:26:46 +0400\")","References":"<20260422202646.272081-1-marcandre.lureau@redhat.com>","Date":"Thu, 23 Apr 2026 07:02:11 +0200","Message-ID":"<87v7dis20c.fsf@pond.sub.org>","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Transfer-Encoding":"quoted-printable","X-Scanned-By":"MIMEDefang 3.4.1 on 10.30.177.111","Received-SPF":"pass client-ip=170.10.129.124; envelope-from=armbru@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"12","X-Spam_score":"1.2","X-Spam_bar":"+","X-Spam_report":"(1.2 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001,\n SPF_PASS=-0.001 autolearn=no autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}},{"id":3681283,"web_url":"http://patchwork.ozlabs.org/comment/3681283/","msgid":"","list_archive_url":null,"date":"2026-04-23T06:28:00","subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","submitter":{"id":66774,"url":"http://patchwork.ozlabs.org/api/people/66774/","name":"Marc-André Lureau","email":"marcandre.lureau@redhat.com"},"content":"Hi\n\nOn Thu, Apr 23, 2026 at 9:02 AM Markus Armbruster wrote:\n>\n> marcandre.lureau@redhat.com writes:\n>\n> > From: Marc-André Lureau \n> >\n> > This commit removes the QemuConsole from the global \"consoles\" list when\n> > it is finalized.\n> >\n> > Previously, there was a TODO comment indicating this path needed\n> > checking. The assertions added ensure that `dcls`, `gl_block`, and the\n> > `dump_queue` are empty before removal, confirming the console is in a\n> > clean state.\n> >\n> > Fix potential use-after-free crashes when a display console is removed.\n> >\n> > Reported-by: Markus Armbruster \n> > Signed-off-by: Marc-André Lureau \n> > ---\n> > ui/console.c | 5 ++++-\n> > 1 file changed, 4 insertions(+), 1 deletion(-)\n> >\n> > diff --git a/ui/console.c b/ui/console.c\n> > index f445db11389..b64e2122f34 100644\n> > --- a/ui/console.c\n> > +++ b/ui/console.c\n> > @@ -394,10 +394,13 @@ qemu_console_finalize(Object *obj)\n> > {\n> > QemuConsole *c = QEMU_CONSOLE(obj);\n> >\n> > - /* TODO: check this code path, and unregister from consoles */\n> > + assert(c->dcls == 0);\n> > + assert(c->gl_block == 0);\n> > + assert(qemu_co_queue_empty(&c->dump_queue));\n>\n> Help me out: what ensures this?\n\n- No display change listener left\n- No GL lock left\n- No pending screendump\n\n>\n> > g_clear_pointer(&c->surface, qemu_free_displaysurface);\n> > g_clear_pointer(&c->gl_unblock_timer, timer_free);\n> > g_clear_pointer(&c->ui_timer, timer_free);\n> > + QTAILQ_REMOVE(&consoles, c, next);\n>\n> Is @consoles only accessed from the main thread?\n\nYes, the UI code is main thread only.","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=PR59tfd/;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=google header.b=Q0qS8Mk7;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1R5H4FRgz1yCv\n\tfor ; Thu, 23 Apr 2026 16:29:22 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wFnYQ-00058N-T0; Thu, 23 Apr 2026 02:28:50 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wFnXt-00057H-Ab\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 02:28:17 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.133.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wFnXr-0003N0-QK\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 02:28:17 -0400","from mail-pj1-f72.google.com (mail-pj1-f72.google.com\n [209.85.216.72]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-20-VHrvyhrIN8-gnf7W08e8Aw-1; Thu, 23 Apr 2026 02:28:13 -0400","by mail-pj1-f72.google.com with SMTP id\n 98e67ed59e1d1-3614272b00cso7733959a91.3\n for ; Wed, 22 Apr 2026 23:28:12 -0700 (PDT)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776925694;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=HZimMnG90xxxn7hT5xJhfeGfTBvNX2U6GixC/DPhQ8U=;\n b=PR59tfd/bedTX27XrFEgrHt7eA6zY+u+7qmAs9R9nQXvQ1sOD0u6Yh3j5GmQTYjvBEwKGk\n yBoss8U3i9+nBEK/nQ3WTlTGp5SsiWQq2Lhy6GPEfkSfpf7j5+TVM/jt11CDvNVIaJ5Ex8\n HUmCNiBOdjq/POVXEyhGJx1XYd780T4=","v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=redhat.com; s=google; t=1776925692; x=1777530492; darn=nongnu.org;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:from:to:cc:subject:date\n :message-id:reply-to;\n bh=HZimMnG90xxxn7hT5xJhfeGfTBvNX2U6GixC/DPhQ8U=;\n b=Q0qS8Mk70oktw5HdybmiUXENzvT3PStrHcu6QTZqD4QzilS+vrB5344cOVoAHJKYz+\n q68zWRYCRj/W0kI/jy+WBAc0pAu10Rjd7WBPE/IuBIXljochM/AFw0msHgCF2fB99E+K\n iDfE0OJR2Mg7jPCxpwnBGTfM80C1oV+IDDmqo5ZAt7zPEqxwI3GrJNDW+zIcChpkxLlw\n SPv8peQn59W+QD1C2jEIOG8SFMFRy7xF4EoRTY3Jri5OP7uKT64q146Gp6jKpKXOI5Ix\n nBnlu4zRP/+B41rvPminOpVVG99TkoDUIhRASIThVi5eSYwGuurKoSQiF1c0z+isET3s\n r64w=="],"X-MC-Unique":"VHrvyhrIN8-gnf7W08e8Aw-1","X-Mimecast-MFC-AGG-ID":"VHrvyhrIN8-gnf7W08e8Aw_1776925692","ARC-Seal":"i=1; a=rsa-sha256; t=1776925692; cv=none;\n d=google.com; s=arc-20240605;\n b=HBdGNW3LeIxguyBy8pGyLEQB5zo50u/8jp+yqizRTt4t1cu2142fKADmu7WQmzP/j0\n qdSRHUvUEsy/EmcTC+zSFlAGQX8S+rPJseLUAP/STnvTEtgeqbHHIbW/wxmcLfZ+CJU6\n X2a7RzzMwiMOekm3iO/IZb5QRYFcU/h3fZdO2/Ga/d6PZUnohX2KDMFV2bJqr7bbUrNS\n 0N8NHvGXK1CXYO4RRkiX5g3zdw/ddbwLj7yCoitakrIywF4bLVyJcYp2+6BnrgeZDGKx\n ACd410QrAVoRR7DHTBgeFYp4EEDEqBt6yy4ppqywVviHOVCqIBXjDfJkqGdlTRieJ0pa\n K43g==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;\n s=arc-20240605;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:dkim-signature;\n bh=HZimMnG90xxxn7hT5xJhfeGfTBvNX2U6GixC/DPhQ8U=;\n fh=8aBEJY+feA7d7ThUvpzyIH9FOGeOtT6IdrliqPJEqPM=;\n b=AQYi7edrDL8z/DFW4kgRgSxb0vsWeD+vMlSCl+Oy9Xq4E9AB3fxFMnUflNy12zKpJA\n EInOrTxn8QXvTGjmR/NQM1kW06uGwez8q+Wec7EdbWRWUcmbiOA9L5igmqCx1+VOndOj\n SYm6zS6D50usKf6NhIAbfIDRNNdMhbRoB+3UuQcfZM2IC5+/7fXREjOSUQIo89X7LjRK\n 9lL0MKLoZLuXkW4YG5D7VWJFY6pQznf07EPJ8FUBnFUSScTFOfifeIw1j00slEB4kt+2\n CPAW1rCdrohM/eOelKFm37X9riXcbDjwsD5LWXcuv/DJk0Fg7gfrRvELsil3vSofRHOM\n KdZA==; darn=nongnu.org","ARC-Authentication-Results":"i=1; mx.google.com; arc=none","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776925692; x=1777530492;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=HZimMnG90xxxn7hT5xJhfeGfTBvNX2U6GixC/DPhQ8U=;\n b=MCtEYMwjtvio/6OxJwhbq5cILj2vDYH7CyZYiLwOn6j2l4cNvkqoJ/QKb2sVoUrYrg\n JCSfmeFDtuQHCDfE2lgD8owiyEMe6iZcwNYoWqtgdfVDF8zm1O7GvKgZ2lQGqKUXTJZg\n FOgVLue/i45cwNiCD1rpaRhdzR+8sJiTrHfpPyhq6BjnoTUrtdLXsgt1G0sFz6crbB0j\n si280OIOvVbTa+nEM1Oh5Yn6xsl1VpWO+FzB+5b5ADNkeg4QumRitoJPWfcXUAFxF2RG\n ra+1NZcRPcDt7kXvU4ksPNPHBslQNlnM1SGfwNtCuKQui6o/S6moy8PxN3tcadx+zebs\n kEQw==","X-Gm-Message-State":"AOJu0YwpUHyWM7Qym601IRCt2TfqC1cv9RL3JsrkEI1BHZ7eMWT0k4h8\n GDNzGLtkaOPH3n0wVltkdxUkUcVkFhxBBE3yaRXI6W6QFjIcCXi6e7tW4vraylTEgnfm4D1YyIM\n U66scgBxfgtxlnIotMeDy7hkS/8u46iHJCu+Y8akHe4CF4CwTgmfVIasSD7y89VVw+2kWXNaUbl\n AFSiX0iY8upRtlSnkD/WIX3XukF/0ghZU=","X-Gm-Gg":"AeBDieucAdrrq0Dq40RcC1bEmfWuxegjvRfTPXF8yyMs4rTU6xJODyAvFrs3+pvN1if\n Z0Y2ad75owg3kpXzEi/CcEpkBJPPBbcKXfu/yFb9yiMex4B4+Bjz5/dd97OPqbvGQPG7lcRBZUp\n OKUCUVjzKLHlSHwlji4V/N8nLyPrS+SG8xKsvwaNdxrJB2WKPPpMtHTrpOBIJeZ38Ysm/SEoo/w\n tF/UIAhdm4qYZ+ZmgcdwKtxb4drk3caj1Pc/YoDhBcqGenEvVrvz3s9iTn1QrbDExeK3YUmYf0h\n K3i2foCSlyoS7MqOg2O8qEl6Njjun9BDeSk=","X-Received":["by 2002:a17:90b:2fc8:b0:35d:a542:2dc4 with SMTP id\n 98e67ed59e1d1-3614047a7b8mr28157580a91.21.1776925691930;\n Wed, 22 Apr 2026 23:28:11 -0700 (PDT)","by 2002:a17:90b:2fc8:b0:35d:a542:2dc4 with SMTP id\n 98e67ed59e1d1-3614047a7b8mr28157564a91.21.1776925691467; Wed, 22 Apr 2026\n 23:28:11 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260422202646.272081-1-marcandre.lureau@redhat.com>\n <87v7dis20c.fsf@pond.sub.org>","In-Reply-To":"<87v7dis20c.fsf@pond.sub.org>","From":"=?utf-8?q?Marc-Andr=C3=A9_Lureau?= ","Date":"Thu, 23 Apr 2026 10:28:00 +0400","X-Gm-Features":"AQROBzDAKViMcQkg7g_gKb0W1kjaEWHAjpQGlgd-ivMhYMdNNttNjuLUxH5Mc8Y","Message-ID":"\n ","Subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","To":"Markus Armbruster ","Cc":"qemu-devel@nongnu.org","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","Received-SPF":"pass client-ip=170.10.133.124; envelope-from=mlureau@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}},{"id":3681296,"web_url":"http://patchwork.ozlabs.org/comment/3681296/","msgid":"<87y0ieqhzz.fsf@pond.sub.org>","list_archive_url":null,"date":"2026-04-23T06:59:44","subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","submitter":{"id":2645,"url":"http://patchwork.ozlabs.org/api/people/2645/","name":"Markus Armbruster","email":"armbru@redhat.com"},"content":"Marc-André Lureau writes:\n\n> Hi\n>\n> On Thu, Apr 23, 2026 at 9:02 AM Markus Armbruster wrote:\n>>\n>> marcandre.lureau@redhat.com writes:\n>>\n>> > From: Marc-André Lureau \n>> >\n>> > This commit removes the QemuConsole from the global \"consoles\" list when\n>> > it is finalized.\n>> >\n>> > Previously, there was a TODO comment indicating this path needed\n>> > checking. The assertions added ensure that `dcls`, `gl_block`, and the\n>> > `dump_queue` are empty before removal, confirming the console is in a\n>> > clean state.\n>> >\n>> > Fix potential use-after-free crashes when a display console is removed.\n>> >\n>> > Reported-by: Markus Armbruster \n>> > Signed-off-by: Marc-André Lureau \n>> > ---\n>> > ui/console.c | 5 ++++-\n>> > 1 file changed, 4 insertions(+), 1 deletion(-)\n>> >\n>> > diff --git a/ui/console.c b/ui/console.c\n>> > index f445db11389..b64e2122f34 100644\n>> > --- a/ui/console.c\n>> > +++ b/ui/console.c\n>> > @@ -394,10 +394,13 @@ qemu_console_finalize(Object *obj)\n>> > {\n>> > QemuConsole *c = QEMU_CONSOLE(obj);\n>> >\n>> > - /* TODO: check this code path, and unregister from consoles */\n>> > + assert(c->dcls == 0);\n>> > + assert(c->gl_block == 0);\n>> > + assert(qemu_co_queue_empty(&c->dump_queue));\n>>\n>> Help me out: what ensures this?\n>\n> - No display change listener left\n> - No GL lock left\n> - No pending screendump\n\nYes, but what ensures none of these are left / pending by the time we\nfinalize?\n\n>> > g_clear_pointer(&c->surface, qemu_free_displaysurface);\n>> > g_clear_pointer(&c->gl_unblock_timer, timer_free);\n>> > g_clear_pointer(&c->ui_timer, timer_free);\n>> > + QTAILQ_REMOVE(&consoles, c, next);\n>>\n>> Is @consoles only accessed from the main thread?\n>\n> Yes, the UI code is main thread only.\n\nGood, thanks!","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=SETNKBpU;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1Rmd3X0qz1yCv\n\tfor ; Thu, 23 Apr 2026 17:00:01 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wFo2T-00023N-8E; Thu, 23 Apr 2026 02:59:53 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wFo2R-00023F-OF\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 02:59:51 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.133.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wFo2Q-0004Uk-2q\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 02:59:51 -0400","from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-64-Z-OF3t5aMs6Qu6mwqh_wiw-1; Thu,\n 23 Apr 2026 02:59:47 -0400","from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id E91E2180034D\n for ; Thu, 23 Apr 2026 06:59:46 +0000 (UTC)","from blackfin.pond.sub.org (unknown [10.44.22.30])\n by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id A8AB51943295\n for ; Thu, 23 Apr 2026 06:59:46 +0000 (UTC)","by blackfin.pond.sub.org (Postfix, from userid 1000)\n id 2012321E6A28; Thu, 23 Apr 2026 08:59:44 +0200 (CEST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776927589;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=WjayMlzyyOPL+OzR+Il2LwgLIx42+tBl/fWFCT7rBRc=;\n b=SETNKBpU3Jz2petZBci2uJ3nHvsbamrzgaklRY1WKc5rsExSxIqmHzpqWZLD3qUCFN0FPb\n EAT9LrAsJGzSJUQZGaj1veLxrK27LQPq6rj+cvkdP4/npYknI6girzVjDHdswg4S1YnDkg\n z50+mE/EtbpY+zPFoltz+1eMvd0P2QE=","X-MC-Unique":"Z-OF3t5aMs6Qu6mwqh_wiw-1","X-Mimecast-MFC-AGG-ID":"Z-OF3t5aMs6Qu6mwqh_wiw_1776927587","From":"Markus Armbruster ","To":"=?utf-8?q?Marc-Andr=C3=A9?= Lureau ","Cc":"qemu-devel@nongnu.org","Subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","In-Reply-To":"\n (\n\t=?utf-8?b?Ik1hcmMtQW5kcsOp?= Lureau\"'s message of \"Thu,\n 23 Apr 2026 10:28:00 +0400\")","References":"<20260422202646.272081-1-marcandre.lureau@redhat.com>\n <87v7dis20c.fsf@pond.sub.org>\n ","Date":"Thu, 23 Apr 2026 08:59:44 +0200","Message-ID":"<87y0ieqhzz.fsf@pond.sub.org>","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Transfer-Encoding":"quoted-printable","X-Scanned-By":"MIMEDefang 3.0 on 10.30.177.17","Received-SPF":"pass client-ip=170.10.133.124; envelope-from=armbru@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}},{"id":3681318,"web_url":"http://patchwork.ozlabs.org/comment/3681318/","msgid":"","list_archive_url":null,"date":"2026-04-23T08:02:16","subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","submitter":{"id":66774,"url":"http://patchwork.ozlabs.org/api/people/66774/","name":"Marc-André Lureau","email":"marcandre.lureau@redhat.com"},"content":"Hi\n\nOn Thu, Apr 23, 2026 at 10:59 AM Markus Armbruster wrote:\n>\n> Marc-André Lureau writes:\n>\n> > Hi\n> >\n> > On Thu, Apr 23, 2026 at 9:02 AM Markus Armbruster wrote:\n> >>\n> >> marcandre.lureau@redhat.com writes:\n> >>\n> >> > From: Marc-André Lureau \n> >> >\n> >> > This commit removes the QemuConsole from the global \"consoles\" list when\n> >> > it is finalized.\n> >> >\n> >> > Previously, there was a TODO comment indicating this path needed\n> >> > checking. The assertions added ensure that `dcls`, `gl_block`, and the\n> >> > `dump_queue` are empty before removal, confirming the console is in a\n> >> > clean state.\n> >> >\n> >> > Fix potential use-after-free crashes when a display console is removed.\n> >> >\n> >> > Reported-by: Markus Armbruster \n> >> > Signed-off-by: Marc-André Lureau \n> >> > ---\n> >> > ui/console.c | 5 ++++-\n> >> > 1 file changed, 4 insertions(+), 1 deletion(-)\n> >> >\n> >> > diff --git a/ui/console.c b/ui/console.c\n> >> > index f445db11389..b64e2122f34 100644\n> >> > --- a/ui/console.c\n> >> > +++ b/ui/console.c\n> >> > @@ -394,10 +394,13 @@ qemu_console_finalize(Object *obj)\n> >> > {\n> >> > QemuConsole *c = QEMU_CONSOLE(obj);\n> >> >\n> >> > - /* TODO: check this code path, and unregister from consoles */\n> >> > + assert(c->dcls == 0);\n> >> > + assert(c->gl_block == 0);\n> >> > + assert(qemu_co_queue_empty(&c->dump_queue));\n> >>\n> >> Help me out: what ensures this?\n> >\n> > - No display change listener left\n> > - No GL lock left\n> > - No pending screendump\n>\n> Yes, but what ensures none of these are left / pending by the time we\n> finalize?\n\nUnfortunately, we don't have much support for unplugging display\nconsoles. So those asserts are mostly there to remind us of further\nissues.. I should probably leave the TODO.\n\nIn general graphics devices do not support hot-plugging. It looks like\nwe are missing a couple of hotpluggable = false in hw/display. So, it\nshould not be reachable today but by using low-level QMP/QOM like in\nthis test.\n\nText console/VC is also poorly supported and leaks, so it will never\nreach qemu_console_finalize() either.\n\nI can try to improve the situation by sending a more complete series,\nso those assert() are unlikely to be reachable in the future.\n\n\n>\n> >> > g_clear_pointer(&c->surface, qemu_free_displaysurface);\n> >> > g_clear_pointer(&c->gl_unblock_timer, timer_free);\n> >> > g_clear_pointer(&c->ui_timer, timer_free);\n> >> > + QTAILQ_REMOVE(&consoles, c, next);\n> >>\n> >> Is @consoles only accessed from the main thread?\n> >\n> > Yes, the UI code is main thread only.\n>\n> Good, thanks!\n>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=iPrsYCrK;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=google header.b=szMPN/j0;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1T9x18Zlz1yD5\n\tfor ; Thu, 23 Apr 2026 18:03:31 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wFp1U-0005iP-3X; Thu, 23 Apr 2026 04:02:57 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wFp1D-0005eL-M3\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 04:02:42 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.133.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from )\n id 1wFp1B-0005oY-E0\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 04:02:38 -0400","from mail-ua1-f69.google.com (mail-ua1-f69.google.com\n [209.85.222.69]) by relay.mimecast.com with ESMTP with STARTTLS\n (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id\n us-mta-662-SOW9rpLtOkKlaxCa_wJ7xg-1; Thu, 23 Apr 2026 04:02:32 -0400","by mail-ua1-f69.google.com with SMTP id\n a1e0cc1a2514c-9539bc7e2d0so10397731241.1\n for ; Thu, 23 Apr 2026 01:02:32 -0700 (PDT)"],"DKIM-Signature":["v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776931354;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=WsWDxmR6XqjVrFB53NH7U8cNq+72c8riXv3g8z5SYkU=;\n b=iPrsYCrKekQSlxm+DtZPbejCl30cXFEpZO0mop0vvXonZI6YPOWIWtekhjy/9WemmnlQVA\n Z2GRatXFDuu6huAvZC9DbfyOMOX+JIwaOQwCEtRgtn5fbtGywEy9Xn+2nF/L0u54AV48lX\n QqVCruml4EkJT/8Zvb6KcCbIPNKMuOk=","v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=redhat.com; s=google; t=1776931351; x=1777536151; darn=nongnu.org;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:from:to:cc:subject:date\n :message-id:reply-to;\n bh=WsWDxmR6XqjVrFB53NH7U8cNq+72c8riXv3g8z5SYkU=;\n b=szMPN/j0ZF1Os/lgUoi0MAmYV+ZsnzbKN54rQRBw+zKvTETC7wg+B8yX0t1G8VFIGp\n LndTjBCrZhTlUAG76OEHas9QY7rpTdiejP3ttG5g/KuqblkfF0zOH3R4BdJbUt+7mJbo\n wpZWYXn3A6gP9fE4wm1q4ycIv2lZXmQhsQJnx6R5TGUlTK5C2rNKTg4kuu3SPIy0VHpt\n qnQcBw3uekROmdc/CHWE/kfPCgVw1ZGZREXw0zEZ+0n6a9qgaTXWTXGv6mGrxL9faZOu\n WUdXdDJQ4Ff6Vp+iO6HU5PdR1UdD9+Y5ol1lnjj8HURessbUosbuVPCOe3/rxVQ83j+n\n Nm8g=="],"X-MC-Unique":"SOW9rpLtOkKlaxCa_wJ7xg-1","X-Mimecast-MFC-AGG-ID":"SOW9rpLtOkKlaxCa_wJ7xg_1776931352","ARC-Seal":"i=1; a=rsa-sha256; t=1776931351; cv=none;\n d=google.com; s=arc-20240605;\n b=F4HhlNDOUkWorIiqpORTswh5s8EFbpIq5Hy8a23HPjr8zk8mHMCEXre2oxwCUnX1qd\n o/KfVZs82xCCVU7oX6iSsufP3WxPqkE1z3bc5f90HBZcF0EiXeQNk97ze8Rl6/jIlmAQ\n CLc9vHtR/3qD5YuvpOxGSeG06gj+rPofyMqXq6+NsBDcCz5gknPxswWZ+t9z6Ma76TvI\n hGrFoZ5qY3Z2Fw0xzvkuhTkUDyJRZMcbsOOhoWsFCzCTNnkCsFeyGLxGQwkqy/et+Tv6\n rGprist391OPL+tCCdRlyNrmKUUdr808NuAKOkT5iDpg1ZMtlqi+rHBkSze7PS5bcptq\n t2eA==","ARC-Message-Signature":"i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com;\n s=arc-20240605;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:dkim-signature;\n bh=WsWDxmR6XqjVrFB53NH7U8cNq+72c8riXv3g8z5SYkU=;\n fh=8aBEJY+feA7d7ThUvpzyIH9FOGeOtT6IdrliqPJEqPM=;\n b=EnDS4GJjVN7Ku0VlIGBDSwioPmm6qe4Rww/BgihAYrVZKgLAkVek5+JOh/UzHyM8PP\n H91MhZHOEZ+GxoDC47jNxpa6rK3BkG4hH4ajUbiX4MrfVdZTG6yoaF9Z2p1p3IyHLrz2\n zl87u2B6ebSMgF60HB0aTc25O0LTtKoJWn8Q+ZCcxa7GMiHLi5/NTcPQA4913/7+MX5n\n xGzkNPDUbISIEJSaefAaTxAIZMyGDvz68P2UYwlHO6/f3HrW2L8wB/DG/M8vO6melqpm\n uZxX5PPXYUJQkaRH+mC7sXqx2bkjJkAESksO/ErgFwHokt3JxIlugbpo39UpSnnlV9wy\n 5H5Q==; darn=nongnu.org","ARC-Authentication-Results":"i=1; mx.google.com; arc=none","X-Google-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1776931351; x=1777536151;\n h=content-transfer-encoding:cc:to:subject:message-id:date:from\n :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from\n :to:cc:subject:date:message-id:reply-to;\n bh=WsWDxmR6XqjVrFB53NH7U8cNq+72c8riXv3g8z5SYkU=;\n b=cyvpaih3+UDTB/iSFCLNBchyyFmvzKsR3nbpKorVgKgXABnFITaPtnMEz0VirUnE6j\n OSNfG0g4wuqHlDmC3Mw4F3Sgn1yCGdgzlJVKUZrVuGXcbLsgeCg9DbDFgjnA8X6qp93f\n WBy3CGpNKlVXcyzvc0mNLUy3yNED/rEi9QHcdoNNbpBpIN9J9eXy6M1YXlA3pOPYWy5p\n 4D09e9ujw0GNSqdrT2XDRRFkfNcFCIEhvW3C0pOGHAiyeRav2C3GfGvFoTwUILV2cMUu\n xXUSMW2yYVX9GQ9JZe/3MOsJoIbvqnSrzaz+k4QufgKcAM5yWRI0gOIVzX9ofmUVIBL4\n ko5Q==","X-Gm-Message-State":"AOJu0YxgWr78hzJUb23FYrLfnJJF0rj2hCZNuCg0Q5rAKLZIAvnxVMaB\n QZa/LS9MGQtnSlxXYUZzcy0u46mWl652HoEB7whwXKkyE6FkRUJEnf+fz2h0igb7BOPJ1a82yuh\n lHMSHOFHmfU6bT7ic9BYsysWMo0vmgBAdf+DCPGggu1o+eft6i0Ha+RKoQNaFYXnksCxmKe9oli\n LfNuYMpbm3xt1NQuH+5Av8fQ0O/9qZC6CAVkuFNq8=","X-Gm-Gg":"AeBDietpWS6SMaYakGDXNFJZAmtQBexSFGksZsJuofBgzBaCZmJy3AouuIko2iMT2N3\n q2FaXxeo03NM4Bsh5VphM3e9FMlU8vyreA5PI7OAuYFKA6h64YiOTiw38VOZkrrUnnrtw4ED26a\n WsUBSJ5fcbsFQRltQ1kmyR6AQh7ifoxbgBzG6qJvwjuZPXzk65Voq3CKzL+vZKhhaiEWP1Yv3KT\n Fq+kpg/DIEkg5UgBYk+zaVICnFJCesw74s1mUPVWSox6EQatVZQC6kKXG+n5YuNHhkbmYqH9YQc\n QUnX2XW8oX6ArvLk3JQvScDZaEgDNh+nu6M=","X-Received":["by 2002:a05:6102:5114:b0:608:ce6d:4db1 with SMTP id\n ada2fe7eead31-616fb5837a1mr8464912137.3.1776931351306;\n Thu, 23 Apr 2026 01:02:31 -0700 (PDT)","by 2002:a05:6102:5114:b0:608:ce6d:4db1 with SMTP id\n ada2fe7eead31-616fb5837a1mr8464907137.3.1776931350835; Thu, 23 Apr 2026\n 01:02:30 -0700 (PDT)"],"MIME-Version":"1.0","References":"<20260422202646.272081-1-marcandre.lureau@redhat.com>\n <87v7dis20c.fsf@pond.sub.org>\n \n <87y0ieqhzz.fsf@pond.sub.org>","In-Reply-To":"<87y0ieqhzz.fsf@pond.sub.org>","From":"=?utf-8?q?Marc-Andr=C3=A9_Lureau?= ","Date":"Thu, 23 Apr 2026 12:02:16 +0400","X-Gm-Features":"AQROBzDBwgWSA3nAYfL4J_iSF7p861XeGR6qFZkET-yFgskH-uKEBWPPkqMxRmE","Message-ID":"\n ","Subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","To":"Markus Armbruster ","Cc":"qemu-devel@nongnu.org","Content-Type":"text/plain; charset=\"UTF-8\"","Content-Transfer-Encoding":"quoted-printable","Received-SPF":"pass client-ip=170.10.133.124; envelope-from=mlureau@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001,\n SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}},{"id":3681372,"web_url":"http://patchwork.ozlabs.org/comment/3681372/","msgid":"<87zf2undu6.fsf@pond.sub.org>","list_archive_url":null,"date":"2026-04-23T10:57:53","subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","submitter":{"id":2645,"url":"http://patchwork.ozlabs.org/api/people/2645/","name":"Markus Armbruster","email":"armbru@redhat.com"},"content":"Marc-André Lureau writes:\n\n> Hi\n>\n> On Thu, Apr 23, 2026 at 10:59 AM Markus Armbruster wrote:\n>>\n>> Marc-André Lureau writes:\n>>\n>> > Hi\n>> >\n>> > On Thu, Apr 23, 2026 at 9:02 AM Markus Armbruster wrote:\n>> >>\n>> >> marcandre.lureau@redhat.com writes:\n>> >>\n>> >> > From: Marc-André Lureau \n>> >> >\n>> >> > This commit removes the QemuConsole from the global \"consoles\" list when\n>> >> > it is finalized.\n>> >> >\n>> >> > Previously, there was a TODO comment indicating this path needed\n>> >> > checking. The assertions added ensure that `dcls`, `gl_block`, and the\n>> >> > `dump_queue` are empty before removal, confirming the console is in a\n>> >> > clean state.\n>> >> >\n>> >> > Fix potential use-after-free crashes when a display console is removed.\n>> >> >\n>> >> > Reported-by: Markus Armbruster \n>> >> > Signed-off-by: Marc-André Lureau \n>> >> > ---\n>> >> > ui/console.c | 5 ++++-\n>> >> > 1 file changed, 4 insertions(+), 1 deletion(-)\n>> >> >\n>> >> > diff --git a/ui/console.c b/ui/console.c\n>> >> > index f445db11389..b64e2122f34 100644\n>> >> > --- a/ui/console.c\n>> >> > +++ b/ui/console.c\n>> >> > @@ -394,10 +394,13 @@ qemu_console_finalize(Object *obj)\n>> >> > {\n>> >> > QemuConsole *c = QEMU_CONSOLE(obj);\n>> >> >\n>> >> > - /* TODO: check this code path, and unregister from consoles */\n>> >> > + assert(c->dcls == 0);\n>> >> > + assert(c->gl_block == 0);\n>> >> > + assert(qemu_co_queue_empty(&c->dump_queue));\n>> >>\n>> >> Help me out: what ensures this?\n>> >\n>> > - No display change listener left\n>> > - No GL lock left\n>> > - No pending screendump\n>>\n>> Yes, but what ensures none of these are left / pending by the time we\n>> finalize?\n>\n> Unfortunately, we don't have much support for unplugging display\n> consoles. So those asserts are mostly there to remind us of further\n> issues.. I should probably leave the TODO.\n>\n> In general graphics devices do not support hot-plugging. It looks like\n> we are missing a couple of hotpluggable = false in hw/display.\n\nI trust you'll take care of them.\n\n> So, it\n> should not be reachable today but by using low-level QMP/QOM like in\n> this test.\n\nDue to QOM's design, introspection must create and destroy a temporary\nobject. This must not have observable side effects.\n\nDevices have a life cycle supporting this:\n\n instance_init -+-> realize ---> unrealize -+-> instance_finalize.\n | |\n +---------------------------+\n\nWe can keep instance_init and instance_finalize free of side effects by\ndoing them in realize and unrealize instead.\n\nNon-device objects lack realize / unrealize. I believe the wheel has\nbeen reinvented a few times there.\n\nBack to qemu_console_finalize(). I guess the correctness argument goes\nroughly like this:\n\n1. After initialization, these assertions hold.\n\n2. Therefore, immediate finalize works. QOM introspection works.\n\n3. Non-immediate finalization cannot happen.\n\nIs this about right?\n\n> Text console/VC is also poorly supported and leaks, so it will never\n> reach qemu_console_finalize() either.\n>\n> I can try to improve the situation by sending a more complete series,\n> so those assert() are unlikely to be reachable in the future.\n\nI'm just trying to understand why this works :)\n\nMore complete patches are always nice, but I'm not demanding you do that\nnow. Comments perhaps?\n\n>> >> > g_clear_pointer(&c->surface, qemu_free_displaysurface);\n>> >> > g_clear_pointer(&c->gl_unblock_timer, timer_free);\n>> >> > g_clear_pointer(&c->ui_timer, timer_free);\n>> >> > + QTAILQ_REMOVE(&consoles, c, next);\n>> >>\n>> >> Is @consoles only accessed from the main thread?\n>> >\n>> > Yes, the UI code is main thread only.\n>>\n>> Good, thanks!\n>>","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=hxkihzkE;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g1Y470bPRz1yCv\n\tfor ; Thu, 23 Apr 2026 20:58:47 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wFrl1-0000uY-Gr; Thu, 23 Apr 2026 06:58:07 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wFrkv-0000tB-A6\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 06:58:03 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.129.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wFrkt-000559-QB\n for qemu-devel@nongnu.org; Thu, 23 Apr 2026 06:58:01 -0400","from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-629-7PWjdNy8MHaOYdZwxZKLuw-1; Thu,\n 23 Apr 2026 06:57:57 -0400","from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 7E041195605A\n for ; Thu, 23 Apr 2026 10:57:56 +0000 (UTC)","from blackfin.pond.sub.org (unknown [10.44.22.30])\n by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id 3D0171800351\n for ; Thu, 23 Apr 2026 10:57:56 +0000 (UTC)","by blackfin.pond.sub.org (Postfix, from userid 1000)\n id B53FD21E6A28; Thu, 23 Apr 2026 12:57:53 +0200 (CEST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776941878;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=RY5j7jHOGxkGDi70dG5O6OtLWIXA4C1iW6USZ+Rp52c=;\n b=hxkihzkE6bIm+1Rxi8b9tjHQbNJoR51fliT4XdZtW4sNPZnVL46FiXc5fc9v/bMgUUO2hE\n waT5PczQzca2UgGKu7/Bg9tx8ItD3ReLuBXmOhfgvxWUUZ9bhOrOLl923GyLGn2RA2Rwqf\n LZ/6344nEs5WgdJvcBllzfEZHfEFUDs=","X-MC-Unique":"7PWjdNy8MHaOYdZwxZKLuw-1","X-Mimecast-MFC-AGG-ID":"7PWjdNy8MHaOYdZwxZKLuw_1776941876","From":"Markus Armbruster ","To":"=?utf-8?q?Marc-Andr=C3=A9?= Lureau ","Cc":"qemu-devel@nongnu.org","Subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","In-Reply-To":"\n (\n\t=?utf-8?b?Ik1hcmMtQW5kcsOp?= Lureau\"'s message of \"Thu,\n 23 Apr 2026 12:02:16 +0400\")","References":"<20260422202646.272081-1-marcandre.lureau@redhat.com>\n <87v7dis20c.fsf@pond.sub.org>\n \n <87y0ieqhzz.fsf@pond.sub.org>\n ","Date":"Thu, 23 Apr 2026 12:57:53 +0200","Message-ID":"<87zf2undu6.fsf@pond.sub.org>","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Transfer-Encoding":"quoted-printable","X-Scanned-By":"MIMEDefang 3.4.1 on 10.30.177.111","Received-SPF":"pass client-ip=170.10.129.124; envelope-from=armbru@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"12","X-Spam_score":"1.2","X-Spam_bar":"+","X-Spam_report":"(1.2 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001,\n SPF_PASS=-0.001 autolearn=no autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}},{"id":3681795,"web_url":"http://patchwork.ozlabs.org/comment/3681795/","msgid":"<87eck4x35p.fsf@pond.sub.org>","list_archive_url":null,"date":"2026-04-24T06:50:42","subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","submitter":{"id":2645,"url":"http://patchwork.ozlabs.org/api/people/2645/","name":"Markus Armbruster","email":"armbru@redhat.com"},"content":"marcandre.lureau@redhat.com writes:\n\n> From: Marc-André Lureau \n>\n> This commit removes the QemuConsole from the global \"consoles\" list when\n> it is finalized.\n>\n> Previously, there was a TODO comment indicating this path needed\n> checking. The assertions added ensure that `dcls`, `gl_block`, and the\n> `dump_queue` are empty before removal, confirming the console is in a\n> clean state.\n>\n> Fix potential use-after-free crashes when a display console is removed.\n\nSuggest to mention reproducers: QMP command qom-list-properties with\ntypename \"qemu-text-console\", \"qemu-fixed-text-console\" or\n\"qemu-graphic-console\".\n\n> Reported-by: Markus Armbruster \n\nPlease add\n\n Cc: qemu-stable@nongnu.org\n\nand Fixes: if it's not too much trouble.\n\n> Signed-off-by: Marc-André Lureau ","headers":{"Return-Path":"","X-Original-To":"incoming@patchwork.ozlabs.org","Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=gOniUpt7;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4g23XT6tGcz1yDD\n\tfor ; Fri, 24 Apr 2026 16:51:36 +1000 (AEST)","from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from )\n\tid 1wGANR-0003RJ-KK; Fri, 24 Apr 2026 02:51:01 -0400","from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wGANI-0003Ps-Ul\n for qemu-devel@nongnu.org; Fri, 24 Apr 2026 02:50:53 -0400","from us-smtp-delivery-124.mimecast.com ([170.10.129.124])\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from ) id 1wGANG-0006P4-JC\n for qemu-devel@nongnu.org; Fri, 24 Apr 2026 02:50:52 -0400","from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-213-cL_K3lbKPiOWaUzWSEpLow-1; Fri,\n 24 Apr 2026 02:50:46 -0400","from mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.111])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 5EB0C18003F6\n for ; Fri, 24 Apr 2026 06:50:45 +0000 (UTC)","from blackfin.pond.sub.org (unknown [10.44.22.30])\n by mx-prod-int-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with\n ESMTPS\n id 1D83B1800351\n for ; Fri, 24 Apr 2026 06:50:45 +0000 (UTC)","by blackfin.pond.sub.org (Postfix, from userid 1000)\n id 9BCCC21E6A28; Fri, 24 Apr 2026 08:50:42 +0200 (CEST)"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1777013447;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding:\n in-reply-to:in-reply-to:references:references;\n bh=eEGRmiI+o5TYoEwWnDpkiwdkRroX4jm7BGZSaJpZ5W0=;\n b=gOniUpt7D29KTRMNQH1lK7Q25TLVtR5HY8jYK7KXcDKUwPrUT09hA6U0UyxWuA3uhM6GWr\n v/oEs8zl4LviZXNiRI7qR4PK14gmJi0ztOed+R69JfKsWI/YK5kab/wvN9bpkBuH517egG\n ri3+sfxchKohywwkRrdqT8XaceroKw0=","X-MC-Unique":"cL_K3lbKPiOWaUzWSEpLow-1","X-Mimecast-MFC-AGG-ID":"cL_K3lbKPiOWaUzWSEpLow_1777013445","From":"Markus Armbruster ","To":"marcandre.lureau@redhat.com","Cc":"qemu-devel@nongnu.org","Subject":"Re: [PATCH] ui/console: remove console from global list on\n finalization","In-Reply-To":"<20260422202646.272081-1-marcandre.lureau@redhat.com> (marcandre\n lureau's message of \"Thu, 23 Apr 2026 00:26:46 +0400\")","References":"<20260422202646.272081-1-marcandre.lureau@redhat.com>","Date":"Fri, 24 Apr 2026 08:50:42 +0200","Message-ID":"<87eck4x35p.fsf@pond.sub.org>","User-Agent":"Gnus/5.13 (Gnus v5.13)","MIME-Version":"1.0","Content-Type":"text/plain; charset=utf-8","Content-Transfer-Encoding":"quoted-printable","X-Scanned-By":"MIMEDefang 3.4.1 on 10.30.177.111","Received-SPF":"pass client-ip=170.10.129.124; envelope-from=armbru@redhat.com;\n helo=us-smtp-delivery-124.mimecast.com","X-Spam_score_int":"-20","X-Spam_score":"-2.1","X-Spam_bar":"--","X-Spam_report":"(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,\n DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no","X-Spam_action":"no action","X-BeenThere":"qemu-devel@nongnu.org","X-Mailman-Version":"2.1.29","Precedence":"list","List-Id":"qemu development ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org","Sender":"qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org"}}]