From 5953a73787b50da56e2ee820a8095ccb09c7a79b Mon Sep 17 00:00:00 2001
From: Cole Robinson <crobinso@redhat.com>
Date: Thu, 5 Dec 2013 15:03:00 -0500
Subject: [PATCH] qemu: hotplug: Fix double free on USB collision

If we hit a collision, we free the USB device while it is still part
of our temporary USBDeviceList. When the list is unref'd, the device
is free'd again.

Make the initial device freeing dependent on whether it is present
in the temporary list or not.
---
 src/qemu/qemu_hotplug.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index bff9e23df5..b7512a71dc 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -1518,7 +1518,10 @@ cleanup:
     }
     if (added)
         virUSBDeviceListSteal(driver->activeUsbHostdevs, usb);
-    virUSBDeviceFree(usb);
+    if (list && usb &&
+        !virUSBDeviceListFind(list, usb) &&
+        !virUSBDeviceListFind(driver->activeUsbHostdevs, usb))
+        virUSBDeviceFree(usb);
     virObjectUnref(list);
     VIR_FREE(devstr);
     return ret;
-- 
2.47.2