shared: Fix crash if adapter is removed before mgmt event is received If "Index Removed" mgmt event is received after a mgmt command was sent by userspace, but before its Command Status/Complete event is received, bluetoothd will eventually call mgmt_cancel_index(), which will destroy the queue of pending commands. By the time request_complete() is called, the request callback is no more valid, because the destroy callback was already called. Therefore, the fix is to simply ignore the event. Valgrind output: ==3676== Invalid read of size 4 ==3676== at 0x80BCD07: request_complete (mgmt.c:239) ==3676== by 0x80BCF72: can_read_data (mgmt.c:350) ==3676== by 0x80BBE22: read_callback (io-glib.c:164) ==3676== by 0x40C019D: g_io_unix_dispatch (giounix.c:166) ==3676== by 0x407FD45: g_main_context_dispatch (gmain.c:2539) ==3676== by 0x40800E4: g_main_context_iterate.isra.21 (gmain.c:3146) ==3676== by 0x408052A: g_main_loop_run (gmain.c:3340) ==3676== by 0x41BE4D2: (below main) (libc-start.c:226) ==3676== Address 0x10 is not stack'd, malloc'd or (recently) free'd

Diffstat

1 files changed, 6 insertions(+), 4 deletions(-)