Make HidConnection::Read reentrancy safe

device/hid/hid_connection_linux.cc

 // Copyright (c) 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/hid/hid_connection_linux.h"
 
 #include <errno.h>
 #include <linux/hidraw.h>
 #include <sys/ioctl.h>
 
@@ skipping 224 matching lines @@
   // buffer can be used directly.
   blocking_task_runner_->PostTask(
       FROM_HERE,
       base::Bind(&FileThreadHelper::SendFeatureReport,
                  base::Unretained(helper_.get()), buffer, size, callback));
 }
 
 void HidConnectionLinux::ProcessInputReport(scoped_refptr<net::IOBuffer> buffer,
                                             size_t size) {
   DCHECK(thread_checker().CalledOnValidThread());
+  DCHECK_GE(size, 1u);
+
+  uint8_t report_id = buffer->data()[0];
+  if (IsReportIdProtected(report_id))
+    return;
+
   PendingHidReport report;
   report.buffer = buffer;
   report.size = size;
   pending_reports_.push(report);
   ProcessReadQueue();
 }
 
 void HidConnectionLinux::ProcessReadQueue() {
   DCHECK(thread_checker().CalledOnValidThread());
+
+  // Hold a reference to |this| to prevent a callback from freeing this object
+  // during the loop.
+  scoped_refptr<HidConnectionLinux> self(this);
   while (pending_reads_.size() && pending_reports_.size()) {
     PendingHidRead read = pending_reads_.front();
     PendingHidReport report = pending_reports_.front();
 
+    pending_reads_.pop();
     pending_reports_.pop();
-    if (CompleteRead(report.buffer, report.size, read.callback))
-      pending_reads_.pop();
+    read.callback.Run(true, report.buffer, report.size);
   }
 }
 
 }  // namespace device