android/avdtp: Fix crash on disconnect Last reference to session may be dropped while calling connection_lost so move watch ID clean before that. external/bluetooth/bluez/android/avdtp.c:session_cb() external/bluetooth/bluez/android/avdtp.c:avdtp_parse_resp() CLOSE request succeeded external/bluetooth/bluez/android/avdtp.c:avdtp_sep_set_state() stream state changed: OPEN -> CLOSING external/bluetooth/bluez/android/a2dp.c:sep_close_cfm() external/bluetooth/bluez/android/avdtp.c:avdtp_sep_set_state() stream state changed: CLOSING -> IDLE external/bluetooth/bluez/android/avdtp.c:session_cb() external/bluetooth/bluez/android/avdtp.c:connection_lost() Disconnected: I/O error (5) external/bluetooth/bluez/android/avdtp.c:avdtp_ref() 0x4a27fc8: ref=2 external/bluetooth/bluez/android/a2dp.c:bt_a2dp_notify_state() device 00:1E:DE:21:85:6A state 0 external/bluetooth/bluez/android/avrcp.c:bt_avrcp_disconnect() external/bluetooth/bluez/android/avctp.c:avctp_shutdown() AVCTP: closing uinput external/bluetooth/bluez/android/avrcp.c:disconnect_cb() external/bluetooth/bluez/android/avdtp.c:avdtp_unref() 0x4a27fc8: ref=1 external/bluetooth/bluez/android/avdtp.c:avdtp_unref() 0x4a27fc8: ref=0 external/bluetooth/bluez/android/avdtp.c:avdtp_free() 0x4a27fc8 ==1225== Invalid write of size 4 ==1225== at 0x11ABDE: session_cb (avdtp.c:2084) ==1225== by 0x48BD9C7: g_io_unix_dispatch (giounix.c:166) ==1225== by 0x48C2CCB: g_main_context_dispatch (gmain.c:2539) ==1225== by 0x48C2ED9: g_main_context_iterate.isra.19 (gmain.c:3146) ==1225== by 0x48C3167: g_main_loop_run (gmain.c:3340) ==1225== by 0x10D379: main (main.c:628) ==1225== Address 0x4a27fdc is 20 bytes inside a block of size 1,104 free'd ==1225== at 0x4897E6C: free (in /system/lib/valgrind/ vgpreload_memcheck-arm-linux.so) ==1225== by 0x48C5E2B: g_free (gmem.c:252) ==1225== by 0x11ABDB: session_cb (avdtp.c:2082) ==1225== by 0x48BD9C7: g_io_unix_dispatch (giounix.c:166) ==1225== by 0x48C2CCB: g_main_context_dispatch (gmain.c:2539) ==1225== by 0x48C2ED9: g_main_context_iterate.isra.19 (gmain.c:3146) ==1225== by 0x48C3167: g_main_loop_run (gmain.c:3340) ==1225== by 0x10D379: main (main.c:628) ==1225==

Diffstat

1 files changed, 1 insertions(+), 2 deletions(-)