[PATCH BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free

[PATCH BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free

[Alex Studer]

When an A2DP stream is created in start_ind, a timer is set, suspending
the AVDTP stream if there have been no users within 5 seconds. However,
if the AVDTP stream transitions to the IDLE state before the timer
fires, the A2DP stream is freed without the timer being cleared. This
meant that when the timer fired, it tried to suspend a stream with a
pointer that was previously freed and so segfaulted.

This commit fixes that by ensuring that suspend_timer is cleared before
freeing the A2DP stream.

This was causing random segfaults when connecting my Sony WH-1000XM5
headphones.

Signed-off-by: Alex Studer <alex@studer.dev>
---
 profiles/audio/a2dp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/profiles/audio/a2dp.c b/profiles/audio/a2dp.c
index 661843a89..4e1362913 100644
--- a/profiles/audio/a2dp.c
+++ b/profiles/audio/a2dp.c
@@ -636,6 +636,11 @@ static void a2dp_stream_free(void *data)
 {
 	struct a2dp_stream *stream = data;
 
+	if (stream->suspend_timer) {
+		timeout_remove(stream->suspend_timer);
+		stream->suspend_timer = 0;
+	}
+
 	avdtp_unref(stream->session);
 	free(stream);
 }
-- 
2.51.0

RE: [BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1262 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1001921

---Test result---

Test Summary:
CheckPatch                    PENDING   0.45 seconds
GitLint                       PENDING   0.38 seconds
BuildEll                      PASS      20.02 seconds
BluezMake                     PASS      2528.19 seconds
MakeCheck                     PASS      23.40 seconds
MakeDistcheck                 PASS      184.26 seconds
CheckValgrind                 PASS      235.56 seconds
CheckSmatch                   PASS      307.41 seconds
bluezmakeextell               PASS      127.93 seconds
IncrementalBuild              PENDING   0.33 seconds
ScanBuild                     PASS      917.66 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 12 Sep 2025 14:20:34 -0400 you wrote:
> When an A2DP stream is created in start_ind, a timer is set, suspending
> the AVDTP stream if there have been no users within 5 seconds. However,
> if the AVDTP stream transitions to the IDLE state before the timer
> fires, the A2DP stream is freed without the timer being cleared. This
> meant that when the timer fired, it tried to suspend a stream with a
> pointer that was previously freed and so segfaulted.
> 
> [...]

Here is the summary with links:
  - [BlueZ] profiles/audio/a2dp: Clear suspend timer on A2DP stream free
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=72b02df3b2b4

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html