OSDN Git Service

audio: Fix crash on gateway close while connected
authorMikel Astiz <mikel.astiz@bmw-carit.de>
Mon, 1 Oct 2012 15:24:06 +0000 (17:24 +0200)
committerJohan Hedberg <johan.hedberg@intel.com>
Tue, 2 Oct 2012 07:44:35 +0000 (10:44 +0300)
commit91cc14225d64ec327672fd9bd845091f41b43213
treef16e0ac1e35d0da0f31e4d091ea82a45873d5b56
parentc8f454489969c64827f3ca60ac5a93e54a97f936
audio: Fix crash on gateway close while connected

RFCOMM and SCO watches need to be removed in gateway_close(), otherwise
the watch callbacks might get called later on, resulting in a second
call to gateway_close().

The issue can be easily reproduced if a device is removed (unpaired) a
device while HFP gateway is connected:

bluetoothd[26579]: audio/gateway.c:path_unregister() Unregistered interface org.bluez.HandsfreeGateway on path /org/bluez/26579/hci0/dev_90_84_0D_B2_C7_04
bluetoothd[26579]: audio/media.c:gateway_state_changed()
bluetoothd[26579]: audio/media.c:gateway_state_changed() Clear endpoint 0x555555822cb0
bluetoothd[26579]: audio/source.c:path_unregister() Unregistered interface org.bluez.AudioSource on path /org/bluez/26579/hci0/dev_90_84_0D_B2_C7_04
bluetoothd[26579]: audio/avdtp.c:avdtp_unref() 0x555555827980: ref=2
bluetoothd[26579]: src/device.c:btd_device_unref() 0x55555581a470: ref=1
bluetoothd[26579]: src/device.c:btd_device_unref() 0x55555581a470: ref=0
bluetoothd[26579]: src/device.c:device_free() 0x55555581a470

Program received signal SIGSEGV, Segmentation fault.
gateway_close (device=0x555555820390) at audio/gateway.c:585
585 if (gw->rfcomm) {
audio/gateway.c