[PATCH 39/60] Fix double memory free on simultaneus deletion of MDLs

[Jose Antonio Santos Cadenas <santoscadenas@xxxxxxxxx>]

From: José Antonio Santos-Cadenas <santoscadenas@xxxxxxxxx>

---
 mcap/mcap.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/mcap/mcap.c b/mcap/mcap.c
index d268bf6..51f0d87 100644
--- a/mcap/mcap.c
+++ b/mcap/mcap.c
@@ -1130,7 +1130,12 @@ static void process_md_delete_mdl_req(struct mcap_mcl *mcl, uint8_t *cmd,
 	mcl->mdls = g_slist_remove(mcl->mdls, mdl);
 	update_mcl_state(mcl);
 	notify = TRUE;
-	mcap_delete_mdl(mdl, &notify);
+	if (mdl->state == MDL_DELETING) {
+		/* Remote deviced requests deleting an MDL that upper profile
+		 * tries to delete, MDL will be freed when reply arrives. */
+		mdl->mcl->cb->mdl_deleted(mdl, mdl->mcl->cb->user_data);
+	} else
+		mcap_delete_mdl(mdl, &notify);
 resp:
 	send4B_cmd(mcl, MCAP_MD_DELETE_MDL_RSP, MCAP_SUCCESS, mdlid);
 }
-- 
1.6.3.3

--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html