From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:49563) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QOWDH-0007xa-Qm for qemu-devel@nongnu.org; Mon, 23 May 2011 10:34:32 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QOWDG-00009t-VW for qemu-devel@nongnu.org; Mon, 23 May 2011 10:34:31 -0400 Received: from mx1.redhat.com ([209.132.183.28]:22329) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QOWDG-00009l-Nk for qemu-devel@nongnu.org; Mon, 23 May 2011 10:34:30 -0400 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p4NEYUJq019762 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 23 May 2011 10:34:30 -0400 Message-ID: <4DDA7073.2060702@redhat.com> Date: Mon, 23 May 2011 16:34:27 +0200 From: Gerd Hoffmann MIME-Version: 1.0 References: <1306143819-30287-1-git-send-email-kraxel@redhat.com> <1306143819-30287-18-git-send-email-kraxel@redhat.com> <4DDA6966.7050307@redhat.com> In-Reply-To: <4DDA6966.7050307@redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 17/18] usb: move cancel callback to USBDeviceInfo List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Hans de Goede Cc: qemu-devel@nongnu.org Hi, > The problem is that the USBDevice lifetime may be shorter then the > USBPacket lifetime, USBPackets are created by uhci.c (for example), > where as the device is managed from the monitor (for example), doing > a usb_del in the monitor using the guest bus:addr will call > usb_device_delete_addr, which will call qdev_free. At this time the > USBDevice struct is gone, and at a later time the uhci code will > cancel any still outstanding async packets, who's owner pointer will > now point to free-ed memory. Good spotting, this is indeed a issue which needs fixing. It isn't introduced by this patch though, it exists even without the usb patch queue. usb-msd.c passes a USBDevice pointer directly as opaque. The usb-linux.c callback function assumes it can dereference aurb->hdev just fine. Both will hit free'ed memory in case the device is unplugged while a async packet is in flight. cheers, Gerd