diff options
| author | Stefan Hajnoczi <stefanha@linux.vnet.ibm.com> | 2011-12-15 10:05:18 +0000 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2011-12-15 09:27:23 -0600 |
| commit | db3a5ed7e4422491dac1f83264ebb01f6667ffc8 (patch) | |
| tree | 59172a410fa2fa10b11c1c221a6e493f5a7d6945 | |
| parent | 56384e8b1eebac750e6186f5041af710433ddc9e (diff) | |
usb: fix usb_qdev_init() error handling again
Commit f462141f18ffdd75847f6459ef83d90b831d12c0 introduced clean up code
when usb_qdev_init() fails. Unfortunately it calls .handle_destroy()
when .init() was never invoked or failed. This can lead to crashes when
.handle_destroy() tries to clean up things that were never initialized.
This patch is careful to undo only those steps that completed along the
usb_qdev_init() code path. It's not as pretty as the unified error
handling in f462141f18ffdd75847f6459ef83d90b831d12c0 but it's necessary.
Signed-off-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
| -rw-r--r-- | hw/usb-bus.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/hw/usb-bus.c b/hw/usb-bus.c index 8cafb76fff..8203390929 100644 --- a/hw/usb-bus.c +++ b/hw/usb-bus.c @@ -77,23 +77,21 @@ static int usb_qdev_init(DeviceState *qdev, DeviceInfo *base) QLIST_INIT(&dev->strings); rc = usb_claim_port(dev); if (rc != 0) { - goto err; + return rc; } rc = dev->info->init(dev); if (rc != 0) { - goto err; + usb_release_port(dev); + return rc; } if (dev->auto_attach) { rc = usb_device_attach(dev); if (rc != 0) { - goto err; + usb_qdev_exit(qdev); + return rc; } } return 0; - -err: - usb_qdev_exit(qdev); - return rc; } static int usb_qdev_exit(DeviceState *qdev) |