The pciDevice structure corresponding to the device being hot-unplugged was freed after it was "stolen" from activeList. The pointer was still used for eg-inactive list. This patch removes the free of the structure and frees it only if reset fails on the device. --- I've added a check for activePci to be non-null. This should not happen now that the activePciHostdevs list does not get corrupted, but if the lookup for some strange reason fails, don't enter pciResetDevice with NULL activePci that would cause a segfault. --- src/qemu/qemu_hotplug.c | 11 +++++++---- 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c index dfca7e2..51b8915 100644 --- a/src/qemu/qemu_hotplug.c +++ b/src/qemu/qemu_hotplug.c @@ -2004,13 +2004,16 @@ qemuDomainDetachHostPciDevice(struct qemud_driver *driver, subsys->u.pci.slot, subsys->u.pci.function); if (pci) { activePci = pciDeviceListSteal(driver->activePciHostdevs, pci); - if (pciResetDevice(activePci, driver->activePciHostdevs, - driver->inactivePciHostdevs) == 0) + if (activePci && + pciResetDevice(activePci, driver->activePciHostdevs, + driver->inactivePciHostdevs) == 0) { qemuReattachPciDevice(activePci, driver); - else + } else { + /* reset of the device failed, treat it as if it was returned */ + pciFreeDevice(activePci); ret = -1; + } pciFreeDevice(pci); - pciFreeDevice(activePci); } else { ret = -1; } -- 1.7.3.4