Fix two independent use-after-free issues in the libusb usb-hostbackend.


The first patch frees USBHostRequest objects when
libusb_submit_transfer() fails, preventing stale USBPacket pointers
from remaining on the request queue.


The second patch deletes the lazily allocated bottom halves during
device unrealize, preventing callbacks from accessing a freed
USBHostDevice.


Tommaso Califano tested the original combined patch and reported that
it looks correct.  This series splits the two fixes so that each change
has its own logical scope and Fixes tag.


Haotian Jiang (2):
  usb-host: free request on libusb submit failure
  usb-host: delete bottom halves during unrealize


 hw/usb/host-libusb.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)


--
2.34.1





发自我的企业微信

On 16/10/2026 09.37, sundayjiang(sundayjiang) wrote:
> Fix two independent use-after-free issues in the libusb usb-host
> backend.
> 
> The first patch frees USBHostRequest objects when
> libusb_submit_transfer() fails, preventing stale USBPacket pointers
> from remaining on the request queue.
> 
> The second patch deletes the lazily allocated bottom halves during
> device unrealize, preventing callbacks from accessing a freed
> USBHostDevice.
> 
> Tommaso Califano tested the original combined patch and reported that
> it looks correct.  This series splits the two fixes so that each change
> has its own logical scope and Fixes tag.
> 
> Haotian Jiang (2):
>    usb-host: free request on libusb submit failure
>    usb-host: delete bottom halves during unrealize
> 
>   hw/usb/host-libusb.c | 29 +++++++++++++++++++++++++++++
>   1 file changed, 29 insertions(+)
Thanks for the fixes. I'll queue these for my next pull request.

But if you could do me a favor: The next time you send patches, please don't 
send them as mime-encoded e-mails. I had to apply these patches manually 
since "git am" refused to parse your mail. I.e. try to use "git send-email" 
the next time, this will make sure that your patches can be processed more 
easily. Thanks!

  Thomas