Hi,
On Sun, Mar 8, 2015 at 8:14 AM, Hsin-Yu Chao <hychao@xxxxxxxxxxxx> wrote:
> When handling DBUS_ERROR_NO_REPLY error in media endpoint, the
> a2dp_setup gets unref'ed in the associated request callback when
> it's called for the first time. A crash happens in the later
> clear_endpoint call with below backtrace that, the request callback
> will be triggered again with NULL session.
> To fix this, remove the additional request callback so that every
> callback only gets triggered for once in clear_endpoint.
>
> 0xb6f30d44 [bluetoothd -avdtp.c:1421 ] setconf_cb
> 0xb6f2c3bb [bluetoothd -a2dp.c:407 ] auto_config
> 0xb6f32c39 [bluetoothd -media.c:137 ] media_endpoint_cancel
> 0xb6f32e8d [bluetoothd -media.c:145 ] clear_endpoint
> 0xb6f32faf [bluetoothd -media.c:276 ] endpoint_reply
>
> ---
> profiles/audio/media.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/profiles/audio/media.c b/profiles/audio/media.c
> index 965b32a..762758b 100644
> --- a/profiles/audio/media.c
> +++ b/profiles/audio/media.c
> @@ -270,9 +270,6 @@ static void endpoint_reply(DBusPendingCall *call, void *user_data)
>
> /* Clear endpoint configuration in case of NO_REPLY error */
> if (dbus_error_has_name(&err, DBUS_ERROR_NO_REPLY)) {
> - if (request->cb)
> - request->cb(endpoint, NULL, size,
> - request->user_data);
> clear_endpoint(endpoint);
> dbus_message_unref(reply);
> dbus_error_free(&err);
> --
> 2.1.2
Applied, thanks.
--
Luiz Augusto von Dentz
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
