libpayload: fix use-after-free in usb_exit()

The controller's shutdown function free()s the controller structure so
we shouldn't access it any more after calling shutdown.

As all controllers detach themself, i.e. unchain themself from usb_hcs,
just keep iterating over usb_hcs until it's NULL.

Change-Id: Ie85caba0f685494c3fe04c550a5a14bc4158a94e
Signed-off-by: Mathias Krause <>
Reviewed-by: Paul Menzel <>
Tested-by: build bot (Jenkins)
Reviewed-by: Anton Kochkov <>
1 file changed