diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2022-11-09 13:02:49 -0800 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2022-11-15 11:22:39 -0800 |
| commit | 7fcd6889fb13858e3f78e9d5e35ffd80d8e0accb (patch) | |
| tree | 2abf7f1ec22a0dcd075a87307cb5fc40f31b26d5 /unit | |
| parent | 918c73acb778e2359abcf5c3fa4c6528164b3910 (diff) | |
| download | bluez-7fcd6889fb13858e3f78e9d5e35ffd80d8e0accb.tar.gz | |
shared/bap: Fix crash when canceling requests
If bt_bap_unref/bap_free is called while there is an ongoing pending
request it may endup calling into bap_notify_ready which will try to
notify ready callbacks while holding a reference, but in case the
reference is already 0 that means it would switch to 1 and back 0
causing a double free.
To prevent that bap_notify_ready now checks that the reference is not 0
with use of bt_bap_ref_safe.
Diffstat (limited to 'unit')
0 files changed, 0 insertions, 0 deletions