From 40769f9bd350be59b9a9ef944c77d63cfc883f2e Mon Sep 17 00:00:00 2001 From: Austin Morton Date: Wed, 27 Dec 2017 05:53:41 -0500 Subject: avoid using list_for_each_entry_safe when closing endpoints to prevent potential infinite loop list_for_each_entry_safe is only safe when the current entry is being removed. If other entries in the list could potentially be removed it can result in an infinite loop. Because usbh_lld_ep_close blocks on each urb during iteration, it may give up its lock on the system and allow an interrupt to remove a different urb from the list, resulting in an infinite loop when the thread resumes. --- os/hal/ports/STM32/LLD/USBHv1/hal_usbh_lld.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'os') diff --git a/os/hal/ports/STM32/LLD/USBHv1/hal_usbh_lld.c b/os/hal/ports/STM32/LLD/USBHv1/hal_usbh_lld.c index a0583a6..3298c20 100644 --- a/os/hal/ports/STM32/LLD/USBHv1/hal_usbh_lld.c +++ b/os/hal/ports/STM32/LLD/USBHv1/hal_usbh_lld.c @@ -594,9 +594,10 @@ void usbh_lld_ep_open(usbh_ep_t *ep) { } void usbh_lld_ep_close(usbh_ep_t *ep) { - usbh_urb_t *urb, *tmp; + usbh_urb_t *urb; uinfof("\t%s: Closing EP...", ep->name); - list_for_each_entry_safe(urb, usbh_urb_t, tmp, &ep->urb_list, node) { + while (!list_empty(&ep->urb_list)) { + urb = list_first_entry(&ep->urb_list, usbh_urb_t, node); uinfof("\t%s: Abort URB, USBH_URBSTATUS_DISCONNECTED", ep->name); _usbh_urb_abort_and_waitS(urb, USBH_URBSTATUS_DISCONNECTED); } -- cgit v1.2.3