diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2015-01-30 15:04:34 +0200 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@intel.com> | 2015-02-02 08:44:15 +0200 |
| commit | 24c79fd933c6c30bca3be1a4aae2a9da7d851327 (patch) | |
| tree | 42f0a51e6bbc98e71f3fb00062dce4bef26013e3 /plugins/policy.c | |
| parent | 300a94fe1f15fc1b05638418d713ffdc5e9519cd (diff) | |
| download | bluez-24c79fd933c6c30bca3be1a4aae2a9da7d851327.tar.gz | |
policy: Fix not removing timers
If service becomes unavailable, due to e.g. the device being removed,
all the related timers should be removed as well otherwise it may cause
crashes such as the following:
Invalid read of size 8
at 0x4A6597: btd_device_get_service (device.c:5335)
by 0x40F49F: policy_connect_ct (policy.c:112)
by 0x4E7F552: ??? (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x4E7EAEA: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x4E7EE87: ??? (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x4E7F1B1: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x40BACF: main (main.c:631)
Address 0x73b9ba8 is 360 bytes inside a block of size 592 free'd
at 0x4C2ACE9: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
by 0x4E847FE: g_free (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x49C83F: device_free (device.c:624)
by 0x4BDB29: remove_interface (object.c:658)
by 0x4BE701: g_dbus_unregister_interface (object.c:1382)
by 0x4A49DC: btd_device_unref (device.c:5173)
by 0x41DC46: avdtp_free (avdtp.c:1138)
by 0x41EE09: connection_lost (avdtp.c:1164)
by 0x422EA5: session_cb (avdtp.c:2263)
by 0x4E7EAEA: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x4E7EE87: ??? (in /usr/lib64/libglib-2.0.so.0.4200.1)
by 0x4E7F1B1: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.4200.1)
Diffstat (limited to 'plugins/policy.c')
| -rw-r--r-- | plugins/policy.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/plugins/policy.c b/plugins/policy.c index 6fb0729ca..9351b8306 100644 --- a/plugins/policy.c +++ b/plugins/policy.c @@ -214,6 +214,11 @@ static void sink_cb(struct btd_service *service, btd_service_state_t old_state, switch (new_state) { case BTD_SERVICE_STATE_UNAVAILABLE: + if (data->sink_timer > 0) { + g_source_remove(data->sink_timer); + data->sink_timer = 0; + } + break; case BTD_SERVICE_STATE_DISCONNECTED: if (old_state == BTD_SERVICE_STATE_CONNECTING) { int err = btd_service_get_error(service); @@ -324,6 +329,11 @@ static void source_cb(struct btd_service *service, switch (new_state) { case BTD_SERVICE_STATE_UNAVAILABLE: + if (data->source_timer > 0) { + g_source_remove(data->source_timer); + data->source_timer = 0; + } + break; case BTD_SERVICE_STATE_DISCONNECTED: if (old_state == BTD_SERVICE_STATE_CONNECTING) { int err = btd_service_get_error(service); @@ -382,6 +392,11 @@ static void controller_cb(struct btd_service *service, switch (new_state) { case BTD_SERVICE_STATE_UNAVAILABLE: + if (data->ct_timer > 0) { + g_source_remove(data->ct_timer); + data->ct_timer = 0; + } + break; case BTD_SERVICE_STATE_DISCONNECTED: break; case BTD_SERVICE_STATE_CONNECTING: @@ -410,6 +425,11 @@ static void target_cb(struct btd_service *service, switch (new_state) { case BTD_SERVICE_STATE_UNAVAILABLE: + if (data->tg_timer > 0) { + g_source_remove(data->tg_timer); + data->tg_timer = 0; + } + break; case BTD_SERVICE_STATE_DISCONNECTED: break; case BTD_SERVICE_STATE_CONNECTING: |