Re: [Qemu-devel] bug in usb_bus_release() ?

[Juergen Gross]

On 27/07/16 16:56, Juergen Gross wrote:
> I can reproduce a problem in qemu with Xen just by adding and removing a
> USB bus. The bus is added via usb_bus_new() in hw/usb/xen-usb.c and
> removed later via usb_bus_release().
> 
> Nothing bad happens until I close an active VNC viewer connected to the
> graphical console emulated by the same qemu process. In the log file I
> see "*** Error in `/usr/lib/xen/bin/qemu-system-i386': corrupted double-
> linked list: 0x000055b236bd56b0 ***" and the qemu process will hang.
> 
> Looking into the sources I suspected a missing
> 
> object_unparent(OBJECT(&usbif->bus));
> 
> after calling usb_bus_release(&usbif->bus) to be the culprit, but
> adding this call didn't help (shouldn't this be called from
> usb_bus_release() instead?)
> 
> I suspect something else is missing in qemu for removing a USB bus
> without leaking resources, but I couldn't find anything up to now. Does
> anyone have an idea what could be wrong?

Okay, problem solved. The bug was completely unrelated to
usb_bus_release(). It was just always triggered just after that call.
The problem was in Xen backend handling releasing more memory than
desired. Patch already sent out.


Juergen