Re: Fix multiple USB use-after-free

2017-05-18 Thread Martin Pieuchot
On 10/03/17(Fri) 15:27, Martin Pieuchot wrote: > In polling mode, finished transfers are processed by the waiting thread. > This happens inside usbd_dopoll(). That means it's unsafe to dereference > ``xfer'' after calling it: > > 352: usbd_dopoll(pipe->device); > 353: if (xfer-

Fix multiple USB use-after-free

2017-03-10 Thread Martin Pieuchot
In polling mode, finished transfers are processed by the waiting thread. This happens inside usbd_dopoll(). That means it's unsafe to dereference ``xfer'' after calling it: 352:usbd_dopoll(pipe->device); 353:if (xfer->done) 354:break; When interrupts