qemu: hotplug: Fix double free on USB collision

If we hit a collision, we free the USB device while it is still part
of our temporary USBDeviceList. When the list is unref'd, the device
is free'd again.

Make the initial device freeing dependent on whether it is present
in the temporary list or not.

(cherry picked from commit 5953a73787b50da56e2ee820a8095ccb09c7a79b)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index d8507eeca1564dbf18f1e655d26d8a726de32222..96033ac54c37b8732a8c7db7671bef693c0f3c55 100644 (file)
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1501,7 +1501,10 @@ cleanup:
     }
     if (added)
         virUSBDeviceListSteal(driver->activeUsbHostdevs, usb);
-    virUSBDeviceFree(usb);
+    if (list && usb &&
+        !virUSBDeviceListFind(list, usb) &&
+        !virUSBDeviceListFind(driver->activeUsbHostdevs, usb))
+        virUSBDeviceFree(usb);
     virObjectUnref(list);
     VIR_FREE(devstr);
     return ret;