diff --git a/libusb/os/linux_usbfs.c b/libusb/os/linux_usbfs.c index c84e805..2b81189 100644 --- a/libusb/os/linux_usbfs.c +++ b/libusb/os/linux_usbfs.c @@ -1860,15 +1860,22 @@ static void op_clear_transfer_priv(struct usbi_transfer *itransfer) USBI_TRANSFER_TO_LIBUSB_TRANSFER(itransfer); struct linux_transfer_priv *tpriv = usbi_transfer_get_os_priv(itransfer); + /* urbs can be freed also in submit_transfer so lock mutex first */ switch (transfer->type) { case LIBUSB_TRANSFER_TYPE_CONTROL: case LIBUSB_TRANSFER_TYPE_BULK: case LIBUSB_TRANSFER_TYPE_INTERRUPT: - free(tpriv->urbs); + usbi_mutex_lock(&itransfer->lock); + if (tpriv->urbs) + free(tpriv->urbs); tpriv->urbs = NULL; + usbi_mutex_unlock(&itransfer->lock); break; case LIBUSB_TRANSFER_TYPE_ISOCHRONOUS: - free_iso_urbs(tpriv); + usbi_mutex_lock(&itransfer->lock); + if (tpriv->iso_urbs) + free_iso_urbs(tpriv); + usbi_mutex_unlock(&itransfer->lock); break; default: usbi_err(TRANSFER_CTX(transfer),