[Qemu-devel] [PATCH] usb: initialize libusb_device to avoid crash

[Qemu-devel] [PATCH] usb: initialize libusb_device to avoid crash

[Jincheng Miao]

If libusb_get_device_list() fails, the uninitialized local variable
libusb_device would be passed to libusb_free_device_list(), that
will cause a crash, like:
(gdb) bt
 #0  0x00007fbbb4bafc10 in pthread_mutex_lock () from /lib64/libpthread.so.0
 #1  0x00007fbbb233e653 in libusb_unref_device (dev=0x6275682d627375)
     at core.c:902
 #2  0x00007fbbb233e739 in libusb_free_device_list (list=0x7fbbb6e8436e,
     unref_devices=<optimized out>) at core.c:653
 #3  0x00007fbbb6cd80a4 in usb_host_auto_check (unused=unused@entry=0x0)
     at hw/usb/host-libusb.c:1446
 #4  0x00007fbbb6cd8525 in usb_host_initfn (udev=0x7fbbbd3c5670)
     at hw/usb/host-libusb.c:912
 #5  0x00007fbbb6cc123b in usb_device_init (dev=0x7fbbbd3c5670)
     at hw/usb/bus.c:106
 ...

So initialize libusb_device at the begin time.

Signed-off-by: Jincheng Miao <jmiao@redhat.com>
---
 hw/usb/host-libusb.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 33b5b9f..c189147 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1522,7 +1522,7 @@ static void usb_host_auto_check(void *unused)
 {
     struct USBHostDevice *s;
     struct USBAutoFilter *f;
-    libusb_device **devs;
+    libusb_device **devs = NULL;
     struct libusb_device_descriptor ddesc;
     int unconnected = 0;
     int i, n;
@@ -1623,7 +1623,7 @@ static void usb_host_auto_check(void *unused)
 
 void usb_host_info(Monitor *mon, const QDict *qdict)
 {
-    libusb_device **devs;
+    libusb_device **devs = NULL;
     struct libusb_device_descriptor ddesc;
     char port[16];
     int i, n;
-- 
1.7.1

Re: [Qemu-devel] [PATCH] usb: initialize libusb_device to avoid crash

[Gonglei (Arei)]

> -----Original Message-----
> From: qemu-devel-bounces+arei.gonglei=huawei.com@nongnu.org
> [mailto:qemu-devel-bounces+arei.gonglei=huawei.com@nongnu.org] On
> Behalf Of Jincheng Miao
> Sent: Friday, June 20, 2014 2:13 PM
> To: qemu-devel@nongnu.org
> Cc: kraxel@redhat.com; Jincheng Miao
> Subject: [Qemu-devel] [PATCH] usb: initialize libusb_device to avoid crash
> 
> If libusb_get_device_list() fails, the uninitialized local variable
> libusb_device would be passed to libusb_free_device_list(), that
> will cause a crash, like:
> (gdb) bt
>  #0  0x00007fbbb4bafc10 in pthread_mutex_lock () from
> /lib64/libpthread.so.0
>  #1  0x00007fbbb233e653 in libusb_unref_device (dev=0x6275682d627375)
>      at core.c:902
>  #2  0x00007fbbb233e739 in libusb_free_device_list (list=0x7fbbb6e8436e,
>      unref_devices=<optimized out>) at core.c:653
>  #3  0x00007fbbb6cd80a4 in usb_host_auto_check
> (unused=unused@entry=0x0)
>      at hw/usb/host-libusb.c:1446
>  #4  0x00007fbbb6cd8525 in usb_host_initfn (udev=0x7fbbbd3c5670)
>      at hw/usb/host-libusb.c:912
>  #5  0x00007fbbb6cc123b in usb_device_init (dev=0x7fbbbd3c5670)
>      at hw/usb/bus.c:106
>  ...
> 
> So initialize libusb_device at the begin time.
> 
> Signed-off-by: Jincheng Miao <jmiao@redhat.com>
> ---
>  hw/usb/host-libusb.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 

Reviewed-by: Gonglei <arei.gonglei@huawei.com>

Best regards,
-Gonglei