Commit: c8c680e14a2f299fe1825c6981edcdbe131cf2fd
Parent: ebfcb76cbeafe5eeaeb751a3cc990d1ae7085128
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Committer: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: 2017-08-24 16:37:08
Tree: eebf6e9ebf6ad1994f91fa699405ebbc3603f1a9

gatt: Fix crash while disconnecting The following crash happens if user shutdown the its pipe before the device gets disconnected: Invalid read of size 8 at 0x4E47ED: io_shutdown (io-glib.c:285) by 0x4D1366: queue_remove_all (queue.c:351) by 0x4A1D22: btd_gatt_client_disconnected (gatt-client.c:2207) by 0x4A517B: att_disconnected_cb (device.c:4663) by 0x4D5945: disconn_handler (att.c:538) by 0x4D0FBF: queue_foreach (queue.c:220) by 0x4D75D9: disconnect_cb (att.c:590) by 0x4E419A: watch_callback (io-glib.c:170) by 0x50CD246: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x50CD5E7: ??? (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x50CD901: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x40CD0E: main (main.c:781) Address 0x9240bc8 is 8 bytes inside a block of size 40 free'd at 0x4C2FD18: free (vg_replace_malloc.c:530) by 0x50D2B4D: g_free (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x4E4200: io_unref (io-glib.c:68) by 0x4E4257: watch_destroy (io-glib.c:107) by 0x50C9C67: ??? (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x50CD27B: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x50CD5E7: ??? (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x50CD901: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.5200.3) by 0x40CD0E: main (main.c:781)

Diffstat

M src/gatt-client.c | 13 +++++++++- - - -

1 files changed, 9 insertions(+), 4 deletions(-)

View Full Diff | Patch