From 01fd3878eb64119364eab82b0e5b3cac88736fa6 Mon Sep 17 00:00:00 2001 Message-Id: <01fd3878eb64119364eab82b0e5b3cac88736fa6.1386932210.git.jdenemar@redhat.com> From: Cole Robinson Date: Mon, 9 Dec 2013 20:12:44 +0100 Subject: [PATCH] qemu: hotplug: Fix double free on USB collision https://bugzilla.redhat.com/show_bug.cgi?id=1025108 If we hit a collision, we free the USB device while it is still part of our temporary USBDeviceList. When the list is unref'd, the device is free'd again. Make the initial device freeing dependent on whether it is present in the temporary list or not. (cherry picked from commit 5953a73787b50da56e2ee820a8095ccb09c7a79b) Signed-off-by: Jiri Denemark --- src/qemu/qemu_hotplug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index f2b6dba..a253a74 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -1377,7 +1377,10 @@ cleanup: } if (added) virUSBDeviceListSteal(driver->activeUsbHostdevs, usb); - virUSBDeviceFree(usb); + if (list && usb && + !virUSBDeviceListFind(list, usb) && + !virUSBDeviceListFind(driver->activeUsbHostdevs, usb)) + virUSBDeviceFree(usb); virObjectUnref(list); VIR_FREE(devstr); return ret; -- 1.8.5.1