From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
In case of BAP the same transport may be reconfigured multiple times
which means it would appears multiple times on endpoint->transports
leading to a crash when disconnecting as the code would attempt to
destroy the same object multiple times.
---
profiles/audio/media.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/profiles/audio/media.c b/profiles/audio/media.c
index c9328ab9bd6e..6947cf96392e 100644
--- a/profiles/audio/media.c
+++ b/profiles/audio/media.c
@@ -1057,6 +1057,8 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
path = media_transport_get_path(transport);
bt_bap_stream_set_user_data(stream, (void *)path);
+ endpoint->transports = g_slist_append(endpoint->transports,
+ transport);
}
msg = dbus_message_new_method_call(endpoint->sender, endpoint->path,
@@ -1064,7 +1066,7 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
"SetConfiguration");
if (msg == NULL) {
error("Couldn't allocate D-Bus message");
- media_transport_destroy(transport);
+ endpoint_remove_transport(endpoint, transport);
return FALSE;
}
@@ -1073,8 +1075,6 @@ static int pac_config(struct bt_bap_stream *stream, struct iovec *cfg,
data->cb = cb;
data->user_data = user_data;
- endpoint->transports = g_slist_append(endpoint->transports, transport);
-
dbus_message_iter_init_append(msg, &iter);
path = media_transport_get_path(transport);
--
2.37.3
