Re: Corruption in bluetoothd if started when adapter was rfkilled

[Johan Hedberg <johan.hedberg@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 603 bytes --]

Hi,

On Fri, Oct 16, 2009, Valmantas Palikša wrote:
> Steps to reproduce:
> 1. rfkill block bluetooth
> 2. start bluetoothd
> 3. kill bluetoothd

I don't seem to have rfkill support (at least using that command) on my
laptop so I can't verify this fix, but could you try the attached patch
and see if it resolves the issue? The problem seems to be that in this use
case we never load/probe the adapter drivers but still call their remove
callbacks when the adapter initialization fails. This causes some drivers
to call btd_adapter_unref on adapter objects for which they do not own a
reference.

Johan

[-- Attachment #2: adapter-init.patch --]
[-- Type: text/x-diff, Size: 444 bytes --]

diff --git a/src/adapter.c b/src/adapter.c
index ab07ca7..d225b86 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -2472,7 +2472,8 @@ void adapter_remove(struct btd_adapter *adapter)
 		device_remove(l->data, FALSE);
 	g_slist_free(adapter->devices);
 
-	unload_drivers(adapter);
+	if (adapter->initialized)
+		unload_drivers(adapter);
 
 	/* Return adapter to down state if it was not up on init */
 	if (adapter->up && !adapter->already_up)