Re: [PATCH 1/2] Fix possible crash on AVDTP Suspend req timeout

[Johan Hedberg <johan.hedberg@nokia.com>]

Hi Dmitriy,

On Wed, Feb 02, 2011, Dmitriy Paliy wrote:
> This fixes possible bluetoothd crash on AVDTP Suspend request timeout
> if A2DP client was destroyed after the request was sent but before its
> timeout handled.
> 
> If Suspend request times out due to any reason, then references to A2DP
> session and stream are cleared in unix_client. Therefore, callback cannot
> be removed when unix_client is destroyed (e.g. on incomming call).
> 
> After that, consequent Abort request is sent. If the request times out
> as well, than stream_state_changed callback is invoked to change AVDTP
> state to Idle, which causes crash due to NULL dereferencing.
> 
> Therefore, it is important to keep references to AVDTP session and stream
> in unix_client until it is destroyed.
> ---
>  audio/unix.c |   15 ++++-----------
>  1 files changed, 4 insertions(+), 11 deletions(-)

Thanks. Both patches have been pushed upstream.

Johan