From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:45581)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1WrMwB-0006Tz-Sj
	for qemu-devel@nongnu.org; Mon, 02 Jun 2014 03:45:50 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1WrMw5-0008Fg-JJ
	for qemu-devel@nongnu.org; Mon, 02 Jun 2014 03:45:43 -0400
Received: from mx1.redhat.com ([209.132.183.28]:56866)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <kraxel@redhat.com>) id 1WrMw5-0008Fc-7K
	for qemu-devel@nongnu.org; Mon, 02 Jun 2014 03:45:37 -0400
Message-ID: <1401695127.22391.17.camel@nilsson.home.kraxel.org>
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Mon, 02 Jun 2014 09:45:27 +0200
In-Reply-To: <1401452542-11080-3-git-send-email-arei.gonglei@huawei.com>
References: <1401452542-11080-1-git-send-email-arei.gonglei@huawei.com>
	<1401452542-11080-3-git-send-email-arei.gonglei@huawei.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 2/6] usb-ohci: add exit function
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: arei.gonglei@huawei.com
Cc: weidong.huang@huawei.com, luonengjun@huawei.com, qemu-devel@nongnu.org, peter.huangpeng@huawei.com

  Hi,

> +static void usb_ohci_exit(PCIDevice *dev)
> +{
> +    OHCIPCIState *ohci = PCI_OHCI(dev);
> +    OHCIState *s = &ohci->state;
> +
> +    memory_region_destroy(&s->mem);
> +
> +    if (!ohci->masterbus) {
> +        usb_bus_release(&s->bus);
> +    }
> +}

This is incomplete.  At minimum you have to care about s->eof_timer.

Same goes for the other host adapters.  There can be timers running and
there might be in-flight usb requests which must be property teared
down, to make sure we don't use-after-free hostadapter state in
callbacks.

cheers,
  Gerd