On 16/10/2026 09.37, sundayjiang(sundayjiang) wrote:
> Fix two independent use-after-free issues in the libusb usb-host
> backend.
>
> The first patch frees USBHostRequest objects when
> libusb_submit_transfer() fails, preventing stale USBPacket pointers
> from remaining on the request queue.
>
> The second patch deletes the lazily allocated bottom halves during
> device unrealize, preventing callbacks from accessing a freed
> USBHostDevice.
>
> Tommaso Califano tested the original combined patch and reported that
> it looks correct.  This series splits the two fixes so that each change
> has its own logical scope and Fixes tag.
>
> Haotian Jiang (2):
>    usb-host: free request on libusb submit failure
>    usb-host: delete bottom halves during unrealize
>
>   hw/usb/host-libusb.c | 29 +++++++++++++++++++++++++++++
>   1 file changed, 29 insertions(+)
Thanks for the fixes. I'll queue these for my next pull request.

But if you could do me a favor: The next time you send patches, please don't
send them as mime-encoded e-mails. I had to apply these patches manually
since "git am" refused to parse your mail. I.e. try to use "git send-email"
the next time, this will make sure that your patches can be processed more
easily. Thanks!

  Thomas