qemu: hotplug: Fix double free on USB collision

If we hit a collision, we free the USB device while it is still part
of our temporary USBDeviceList. When the list is unref'd, the device
is free'd again.

Make the initial device freeing dependent on whether it is present
in the temporary list or not.

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index bff9e23df5103bf5d21e20c186d6d0e6d1fab81b..b7512a71dcd849ae84a1c08700fd37c0684cd21d 100644 (file)
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1518,7 +1518,10 @@ cleanup:
     }
     if (added)
         virUSBDeviceListSteal(driver->activeUsbHostdevs, usb);
-    virUSBDeviceFree(usb);
+    if (list && usb &&
+        !virUSBDeviceListFind(list, usb) &&
+        !virUSBDeviceListFind(driver->activeUsbHostdevs, usb))
+        virUSBDeviceFree(usb);
     virObjectUnref(list);
     VIR_FREE(devstr);
     return ret;