From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:43361) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QOYxA-0001tp-PP for qemu-devel@nongnu.org; Mon, 23 May 2011 13:30:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QOYx9-00012a-LE for qemu-devel@nongnu.org; Mon, 23 May 2011 13:30:04 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34425) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QOYx9-000129-BU for qemu-devel@nongnu.org; Mon, 23 May 2011 13:30:03 -0400 Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id p4NHU2P1030122 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 23 May 2011 13:30:02 -0400 Message-ID: <4DDA999E.30501@redhat.com> Date: Mon, 23 May 2011 19:30:06 +0200 From: Hans de Goede MIME-Version: 1.0 References: <1306143819-30287-1-git-send-email-kraxel@redhat.com> <1306143819-30287-18-git-send-email-kraxel@redhat.com> <4DDA6966.7050307@redhat.com> <4DDA7073.2060702@redhat.com> In-Reply-To: <4DDA7073.2060702@redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 17/18] usb: move cancel callback to USBDeviceInfo List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Gerd Hoffmann Cc: qemu-devel@nongnu.org Hi, On 05/23/2011 04:34 PM, Gerd Hoffmann wrote: > Hi, > >> The problem is that the USBDevice lifetime may be shorter then the >> USBPacket lifetime, USBPackets are created by uhci.c (for example), >> where as the device is managed from the monitor (for example), doing >> a usb_del in the monitor using the guest bus:addr will call >> usb_device_delete_addr, which will call qdev_free. At this time the >> USBDevice struct is gone, and at a later time the uhci code will >> cancel any still outstanding async packets, who's owner pointer will >> now point to free-ed memory. > > Good spotting, this is indeed a issue which needs fixing. It isn't introduced by this patch though, it exists even without the usb patch queue. > > usb-msd.c passes a USBDevice pointer directly as opaque. The usb-linux.c callback function assumes it can dereference aurb->hdev just fine. Ah, that is no good, my usb network redir device code uses aurb's similar too linux.c, but on device-destroy walks its list of pending aurbs, sends a cancel to the host-os, and sets aurb->hdev to null, and the async cancel checks for aurb->hdev being NULL and in that case only frees the aurb and does nothing else. > Both will hit free'ed memory in case the device is unplugged while a async packet is in flight. Yep, linux.c could be fixed the same way as my usb net redir device code. But I like the patch you just send better. It looks incomplete though, I'll give more details in a reply to the patch it self. Regards, Hans