From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 25 Aug 2011 14:43:15 +0000 (+0200)
Subject: usb: fix use after free
X-Git-Tag: v1.0-rc0~339^2~7
X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=4d8debba766265d70cb7bf11570e3622512641d6;p=qemu.git

usb: fix use after free

The ->complete() callback might have released the USBPacket (uhci
actually does), so we must not touch it after the callback returns.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---

diff --git a/hw/usb.c b/hw/usb.c
index 685e775a0..a091e4eaf 100644
--- a/hw/usb.c
+++ b/hw/usb.c
@@ -338,8 +338,8 @@ void usb_packet_complete(USBDevice *dev, USBPacket *p)
 {
     /* Note: p->owner != dev is possible in case dev is a hub */
     assert(p->owner != NULL);
-    dev->port->ops->complete(dev->port, p);
     p->owner = NULL;
+    dev->port->ops->complete(dev->port, p);
 }
 
 /* Cancel an active packet.  The packed must have been deferred by