usbredirhost: lock host earlier in async packet completion callbacks

The transfer->foo_packet union members are also used on cancellation, and
completion and cancellation may race, so they should not be accessed without
holding the lock.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>

1 files changed, 6 insertions, 5 deletions

diff --git a/usbredirhost/usbredirhost.c b/usbredirhost/usbredirhost.c
index f677593..dcb0940 100644
--- a/usbredirhost/usbredirhost.c
+++ b/usbredirhost/usbredirhost.c
@@ -1972,6 +1972,8 @@ static void LIBUSB_CALL usbredirhost_control_packet_complete(
     struct usbredirtransfer *transfer = libusb_transfer->user_data;
     struct usbredirhost *host = transfer->host;
 
+    LOCK(host);
+
     control_packet = transfer->control_packet;
     control_packet.status = libusb_status_or_error_to_redir_status(host,
                                                   libusb_transfer->status);
@@ -1981,8 +1983,6 @@ static void LIBUSB_CALL usbredirhost_control_packet_complete(
           control_packet.endpoint, control_packet.status,
           control_packet.length, transfer->id);
 
-    LOCK(host);
-
     if (!transfer->cancelled) {
         if (control_packet.endpoint & LIBUSB_ENDPOINT_IN) {
             usbredirhost_log_data(host, "ctrl data in:",
@@ -2113,6 +2113,8 @@ static void LIBUSB_CALL usbredirhost_bulk_packet_complete(
     struct usbredirtransfer *transfer = libusb_transfer->user_data;
     struct usbredirhost *host = transfer->host;
 
+    LOCK(host);
+
     bulk_packet = transfer->bulk_packet;
     bulk_packet.status = libusb_status_or_error_to_redir_status(host,
                                                   libusb_transfer->status);
@@ -2123,8 +2125,6 @@ static void LIBUSB_CALL usbredirhost_bulk_packet_complete(
           bulk_packet.endpoint, bulk_packet.status,
           libusb_transfer->actual_length, transfer->id);
 
-    LOCK(host);
-
     if (!transfer->cancelled) {
         if (bulk_packet.endpoint & LIBUSB_ENDPOINT_IN) {
             usbredirhost_log_data(host, "bulk data in:",
@@ -2339,6 +2339,8 @@ static void LIBUSB_CALL usbredirhost_interrupt_out_packet_complete(
     struct usb_redir_interrupt_packet_header interrupt_packet;
     struct usbredirhost *host = transfer->host;
 
+    LOCK(host);
+
     interrupt_packet = transfer->interrupt_packet;
     interrupt_packet.status = libusb_status_or_error_to_redir_status(host,
                                                     libusb_transfer->status);
@@ -2348,7 +2350,6 @@ static void LIBUSB_CALL usbredirhost_interrupt_out_packet_complete(
           interrupt_packet.endpoint, interrupt_packet.status,
           interrupt_packet.length, transfer->id);
 
-    LOCK(host);
     if (!transfer->cancelled) {
         usbredirparser_send_interrupt_packet(host->parser, transfer->id,
                                              &interrupt_packet, NULL, 0);