usb_raw: abort transfers cleanly on kill, fix use-after-free

* aborted transfers will release the notify semaphore when the cancel is notified. * the allocated buffer would be freed on return, while the usb stack eventually copied data in the buffer in our back, leading to KDL crashes, because the freed buffer would be right reallocated for some kernel team structures. * regression introduced by hrev55806, the transfers didn't need to be cancelled before. Change-Id: Ifb6e941f71d05c37c36f878059c33883bb72a67c Reviewed-on: https://review.haiku-os.org/c/haiku/+/5905 Reviewed-by: Adrien Destugues <[email protected]> Reviewed-by: waddlesplash <[email protected]> Tested-by: Commit checker robot <[email protected]>
2022-12-14 04:53:09 +00:00
parent 215b685f7f
commit 76ddb69a3a
3 changed files with 31 additions and 7 deletions
@@ -247,6 +247,10 @@ struct usb_module_info {
 										uint8 portIndex);
 	status_t						(*disable_port)(usb_device hub,
 										uint8 portIndex);
+
+	/* Cancel all pending async requests in a device control pipe */
+	status_t						(*cancel_queued_requests)(usb_device device);
+
 };