Re: [PATCH 2/9] hw/usb/dev-mtp: Reset pending write state on cancel, reset and error

["Tommaso Califano" <tcalifano@redhat.com>]

On Fri Nov 13, 2026 at 9:33 AM CET, marcandre.lureau wrote:
>> The pending state (s->dataset.filename, s->data_out, s->write_pending)
>> was only partially released when a transaction was canceled, the session
>> closed, the device reset, or the write failed. This left dangling
>> pointers and leaked memory.
>> 
>> Free and clear these fields consistently on all those paths, and route
>> the early error in usb_mtp_write_data() through the common cleanup.
>> 
>> Cc: qemu-stable@nongnu.org
>> Fixes: 53735bef108c ("usb-mtp: Advertise SendObjectInfo for write support")
>> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4529
>> Suggested-by: Hui Peng <https://gitlab.com/benquike>
>> Signed-off-by: Tommaso Califano <tcalifano@redhat.com>
>> Message-ID: <20261112174907.158825-3-tcalifano@redhat.com>
>> ---
>>  hw/usb/dev-mtp.c | 22 +++++++++++++++-------
>>  1 file changed, 15 insertions(+), 7 deletions(-)
>>
>> diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
>> index bc5a6f089178..1c14770a9c05 100644
>> --- a/hw/usb/dev-mtp.c
>> +++ b/hw/usb/dev-mtp.c
>> @@ -1236,6 +1236,13 @@ static void usb_mtp_object_delete(MTPState *s, uint32_t handle,
>>      }
>>  }
>>  
>> +static void usb_mtp_reset_pending_write(MTPState *s) {
>
> QEMU C style puts the opening brace of a function definition on its own line.
>

Yes, sorry I miss that.

>> +    g_free(s->dataset.filename);
>> +    s->dataset.filename = NULL;
>> +    s->write_pending = false;
>> +    s->dataset.size = 0;
>
> Consider also clearing dataset.format and dataset.parent_handle here.

I'll check it.

Thanks,
Tommaso