Fix two independent use-after-free issues in the libusb usb-hostbackend.
The first patch frees USBHostRequest objects when libusb_submit_transfer() fails, preventing stale USBPacket pointers from remaining on the request queue. The second patch deletes the lazily allocated bottom halves during device unrealize, preventing callbacks from accessing a freed USBHostDevice. Tommaso Califano tested the original combined patch and reported that it looks correct. This series splits the two fixes so that each change has its own logical scope and Fixes tag. Haotian Jiang (2): usb-host: free request on libusb submit failure usb-host: delete bottom halves during unrealize hw/usb/host-libusb.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) -- 2.34.1 发自我的企业微信
