When the control channel is destroyed if there is a pending request (chan->p) then the channel queue is deleted in avctp_channel_destroy but the timer is still alive resulting in a SIGSEGV --- profiles/audio/avctp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/profiles/audio/avctp.c b/profiles/audio/avctp.c index eb1d35e..e65594d 100644 --- a/profiles/audio/avctp.c +++ b/profiles/audio/avctp.c @@ -390,6 +390,9 @@ static void avctp_channel_destroy(struct avctp_channel *chan) if (chan->watch) g_source_remove(chan->watch); + if (chan->p) + pending_destroy(chan->p, NULL); + if (chan->process_id > 0) g_source_remove(chan->process_id); -- 1.8.1 -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
