USB: Always delete transfers even when force-canceling.

We can't call the callbacks (as the comments correctly indicated),
but we can certainly delete the transfer objects, since they
rightfully belong to us.

Should fix #19242, #19241, #19180 and possibly other recent regressions.
Also fixes a long-standing memory leak from this scenario.

src/add-ons/kernel/busses/usb/ehci.cpp

@@ -1761,10 +1761,6 @@ EHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 				descriptor = descriptor->next_log;
 			}
 
-			if (!force) {
-				// if the transfer is canceled by force, the one causing the
-				// cancel is probably not the one who initiated the transfer
-				// and the callback is likely not safe anymore
 			transfer_entry *entry
 				= (transfer_entry *)malloc(sizeof(transfer_entry));
 			if (entry != NULL) {
@@ -1773,7 +1769,6 @@ EHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 				entry->next = list;
 				list = entry;
 			}
-			}
 
 			current->canceled = true;
 		}
@@ -1785,7 +1780,13 @@ EHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 
 	while (list != NULL) {
 		transfer_entry *next = list->next;
+
+		// if the transfer is canceled by force, the one causing the
+		// cancel is possibly not the one who initiated the transfer
+		// and the callback is likely not safe anymore
+		if (!force)
 			list->transfer->Finished(B_CANCELED, 0);
+
 		delete list->transfer;
 		free(list);
 		list = next;

src/add-ons/kernel/busses/usb/ohci.cpp

@@ -704,7 +704,6 @@ OHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 			current->endpoint->head_physical_descriptor
 				= current->endpoint->tail_physical_descriptor;
 
-			if (!force) {
 			if (pipe->Type() & USB_OBJECT_ISO_PIPE) {
 				ohci_isochronous_td *descriptor
 					= (ohci_isochronous_td *)current->first_descriptor;
@@ -724,9 +723,6 @@ OHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 				}
 			}
 
-				// If the transfer is canceled by force, the one causing the
-				// cancel is probably not the one who initiated the transfer
-				// and the callback is likely not safe anymore
 			transfer_entry *entry
 				= (transfer_entry *)malloc(sizeof(transfer_entry));
 			if (entry != NULL) {
@@ -735,7 +731,7 @@ OHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 				entry->next = list;
 				list = entry;
 			}
-			}
+
 			current->canceled = true;
 		}
 		current = current->link;
@@ -745,7 +741,13 @@ OHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 
 	while (list != NULL) {
 		transfer_entry *next = list->next;
+
+		// If the transfer is canceled by force, the one causing the
+		// cancel is possibly not the one who initiated the transfer
+		// and the callback is likely not safe anymore
+		if (!force)
 			list->transfer->Finished(B_CANCELED, 0);
+
 		delete list->transfer;
 		free(list);
 		list = next;

src/add-ons/kernel/busses/usb/uhci.cpp

@@ -1006,10 +1006,6 @@ UHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 				descriptor = (uhci_td *)descriptor->link_log;
 			}
 
-			if (!force) {
-				// if the transfer is canceled by force, the one causing the
-				// cancel is probably not the one who initiated the transfer
-				// and the callback is likely not safe anymore
 			transfer_entry *entry
 				= (transfer_entry *)malloc(sizeof(transfer_entry));
 			if (entry != NULL) {
@@ -1018,7 +1014,6 @@ UHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 				entry->next = list;
 				list = entry;
 			}
-			}
 
 			current->canceled = true;
 		}
@@ -1029,7 +1024,13 @@ UHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 
 	while (list != NULL) {
 		transfer_entry *next = list->next;
+
+		// if the transfer is canceled by force, the one causing the
+		// cancel is possibly not the one who initiated the transfer
+		// and the callback is likely not safe anymore
+		if (!force)
 			list->transfer->Finished(B_CANCELED, 0);
+
 		delete list->transfer;
 		free(list);
 		list = next;

src/add-ons/kernel/busses/usb/xhci.cpp

@@ -1117,12 +1117,8 @@ XHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 		if (td->transfer == NULL)
 			continue;
 
-		// We can't cancel or delete transfers under "force", as they probably
-		// are not safe to use anymore.
-		if (!force) {
 		transfers[transfersCount] = td->transfer;
 		transfersCount++;
-		}
 		td->transfer = NULL;
 	}
 
@@ -1179,7 +1175,12 @@ XHCI::CancelQueuedTransfers(Pipe *pipe, bool force)
 	endpointLocker.Unlock();
 
 	for (int32 i = 0; i < transfersCount; i++) {
+		// If the transfer is canceled by force, the one causing the
+		// cancel is possibly not the one who initiated the transfer
+		// and the callback is likely not safe anymore.
+		if (!force)
 			transfers[i]->Finished(B_CANCELED, 0);
+
 		delete transfers[i];
 	}