public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
From: Alex Studer <alex@studer.dev>
To: linux-bluetooth@vger.kernel.org
Cc: Alex Studer <alex@studer.dev>
Subject: [PATCH BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free
Date: Fri, 12 Sep 2025 14:20:34 -0400	[thread overview]
Message-ID: <20250912182033.1260032-2-alex@studer.dev> (raw)

When an A2DP stream is created in start_ind, a timer is set, suspending
the AVDTP stream if there have been no users within 5 seconds. However,
if the AVDTP stream transitions to the IDLE state before the timer
fires, the A2DP stream is freed without the timer being cleared. This
meant that when the timer fired, it tried to suspend a stream with a
pointer that was previously freed and so segfaulted.

This commit fixes that by ensuring that suspend_timer is cleared before
freeing the A2DP stream.

This was causing random segfaults when connecting my Sony WH-1000XM5
headphones.

Signed-off-by: Alex Studer <alex@studer.dev>
---
 profiles/audio/a2dp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index 661843a89..4e1362913 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -636,6 +636,11 @@ static void a2dp_stream_free(void *data)
 {
 	struct a2dp_stream *stream = data;
 
+	if (stream->suspend_timer) {
+		timeout_remove(stream->suspend_timer);
+		stream->suspend_timer = 0;
+	}
+
 	avdtp_unref(stream->session);
 	free(stream);
 }
-- 
2.51.0



             reply	other threads:[~2025-09-12 18:36 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-09-12 18:20 Alex Studer [this message]
2025-09-12 19:58 ` [BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free bluez.test.bot
2025-09-18 13:30 ` [PATCH BlueZ] " patchwork-bot+bluetooth

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250912182033.1260032-2-alex@studer.dev \
    --to=alex@studer.dev \
    --cc=linux-bluetooth@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox