This adds a check for the PA request dequeued in bap_bcast_remove, to avoid accessing a member within a NULL pointer. --- profiles/audio/bap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/profiles/audio/bap.c b/profiles/audio/bap.c index afa938091..16c02524f 100644 --- a/profiles/audio/bap.c +++ b/profiles/audio/bap.c @@ -3194,7 +3194,7 @@ static void bap_bcast_remove(struct btd_service *service) */ req = queue_remove_if(data->adapter->bcast_pa_requests, match_service, service); - if (req->io_id) { + if (req && req->io_id) { g_source_remove(req->io_id); req->io_id = 0; } -- 2.39.2