回复：[Internet]Re: [PATCH 0/2] usb-host: fix use-after-free issues

回复：[Internet]Re: [PATCH 0/2] usb-host: fix use-after-free issues

[sundayjiang(sundayjiang)]

[-- Attachment #1: Type: text/plain, Size: 1814 bytes --]

Hi Thomas,  
Thank you for applying and queuing the patches. Sorry for the formatting issue. I’ll use git send-email next time.  
Best regards,
Haotian Jiang





                    Thomas Huth<thuth@redhat.com&gt;&nbsp;在 2026年10月16日 周五 21:14 写道：

On 16/10/2026 09.37, sundayjiang(sundayjiang) wrote:
&gt; Fix two independent use-after-free issues in the libusb usb-host
&gt; backend.
&gt; 
&gt; The first patch frees USBHostRequest objects when
&gt; libusb_submit_transfer() fails, preventing stale USBPacket pointers
&gt; from remaining on the request queue.
&gt; 
&gt; The second patch deletes the lazily allocated bottom halves during
&gt; device unrealize, preventing callbacks from accessing a freed
&gt; USBHostDevice.
&gt; 
&gt; Tommaso Califano tested the original combined patch and reported that
&gt; it looks correct. &nbsp;This series splits the two fixes so that each change
&gt; has its own logical scope and Fixes tag.
&gt; 
&gt; Haotian Jiang (2):
&gt;&nbsp; &nbsp; usb-host: free request on libusb submit failure
&gt;&nbsp; &nbsp; usb-host: delete bottom halves during unrealize
&gt; 
&gt;&nbsp; &nbsp;hw/usb/host-libusb.c | 29 +++++++++++++++++++++++++++++
&gt;&nbsp; &nbsp;1 file changed, 29 insertions(+)
Thanks for the fixes. I'll queue these for my next pull request.

But if you could do me a favor: The next time you send patches, please don't 
send them as mime-encoded e-mails. I had to apply these patches manually 
since "git am" refused to parse your mail. I.e. try to use "git send-email" 
the next time, this will make sure that your patches can be processed more 
easily. Thanks!

&nbsp; Thomas

[-- Attachment #2: Type: text/html, Size: 2560 bytes --]