When handling DBUS_ERROR_NO_REPLY error in media endpoint, the a2dp_setup gets unref'ed in the associated request callback. We need to remove the request from list once it has been handled, or in the following clear_endpoint call this request callback will be triggered again with NULL session and cause crash. --- profiles/audio/media.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/profiles/audio/media.c b/profiles/audio/media.c index 965b32a..0bb82eb 100644 --- a/profiles/audio/media.c +++ b/profiles/audio/media.c @@ -273,6 +273,9 @@ static void endpoint_reply(DBusPendingCall *call, void *user_data) if (request->cb) request->cb(endpoint, NULL, size, request->user_data); + endpoint->requests = g_slist_remove(endpoint->requests, + request); + endpoint_request_free(request); clear_endpoint(endpoint); dbus_message_unref(reply); dbus_error_free(&err); -- 2.1.2 -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
