Hi,
The problem is that the USBDevice lifetime may be shorter then the USBPacket lifetime, USBPackets are created by uhci.c (for example), where as the device is managed from the monitor (for example), doing a usb_del in the monitor using the guest bus:addr will call usb_device_delete_addr, which will call qdev_free. At this time the USBDevice struct is gone, and at a later time the uhci code will cancel any still outstanding async packets, who's owner pointer will now point to free-ed memory.
Good spotting, this is indeed a issue which needs fixing. It isn't introduced by this patch though, it exists even without the usb patch queue.
usb-msd.c passes a USBDevice pointer directly as opaque. The usb-linux.c callback function assumes it can dereference aurb->hdev just fine. Both will hit free'ed memory in case the device is unplugged while a async packet is in flight.
cheers, Gerd
