[Qemu-devel] [PATCH] hw/usb/redirect.c: crash in QOM cleanup

[Qemu-devel] [PATCH] hw/usb/redirect.c: crash in QOM cleanup

[Martin Cerveny]

Hello.

Qemu crashes during remote usb device removal.
The associated chardev is destroyed "qemu_chr_delete()" in 
"usbredir_handle_destroy()" but pointer is not 
cleared. QOM cleanup is using pointer to previously freed 
memory.

Example cmds:

chardev-add socket,id=usbredirchardev1,port=4000,host=192.168.1.166
device_add usb-redir,chardev=usbredirchardev1,id=usbredirdev1,bus=ehci.0,debug=4
device_del usbredirdev1

core_backtrace:

0x2693a2 qemu_chr_add_handlers - -
0x1366bf release_chr - -
0x2808d8 object_property_del_all - -
0x280b35 object_finalize - -
0x281654 object_unref - -
0x280a4b object_unparent - -
0x13ad93 qdev_free - -
0x13acde qdev_simple_unplug_cb - -
0x13aac8 qdev_unplug - -
0x268b56 qmp_device_del - -
....

Signed-off-by: Martin Cerveny <M.Cerveny@computer.org>
---
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index a594e95..1c62263 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
      USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);

      qemu_chr_delete(dev->cs);
+    dev->cs = NULL;
      /* Note must be done after qemu_chr_close, as that causes a close 
event */
      qemu_bh_delete(dev->chardev_close_bh);

---

Re: [Qemu-devel] [PATCH] hw/usb/redirect.c: crash in QOM cleanup

[Gerd Hoffmann]

  Hi,

> diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
> index a594e95..1c62263 100644
> --- a/hw/usb/redirect.c
> +++ b/hw/usb/redirect.c
> @@ -1334,6 +1334,7 @@ static void usbredir_handle_destroy(USBDevice *udev)
>      USBRedirDevice *dev = DO_UPCAST(USBRedirDevice, dev, udev);
> 
>      qemu_chr_delete(dev->cs);
> +    dev->cs = NULL;
>      /* Note must be done after qemu_chr_close, as that causes a close
> event */
>      qemu_bh_delete(dev->chardev_close_bh);

Patch doesn't apply, probably because it is whitespace-mangled.  Redid
it.  Please use 'git send-email' to send patches in the future, it is
more robust.

cheers,
  Gerd