From ef2cc5e8eaaf1a534def6c28f6b0d87a7dd807b3 Mon Sep 17 00:00:00 2001 From: Arman Uguray Date: Mon, 8 Dec 2014 16:40:44 -0800 Subject: [PATCH] shared/att: cancel_all before calling disconnect cb Moved the call to bt_att_cancel_all to before the call to the registered disconnect callbacks in bt_att's internal disconnect handler to make sure that all affected user_data is destroyed. This is to prevent cases of invalid access, where a user_data destroy function refers to data that the upper layer might free in the disconnect callback. --- src/shared/att.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/shared/att.c b/src/shared/att.c index 3181b3664..26b6c5bc3 100644 --- a/src/shared/att.c +++ b/src/shared/att.c @@ -554,6 +554,8 @@ static bool disconnect_cb(struct io *io, void *user_data) util_debug(att->debug_callback, att->debug_data, "Physical link disconnected"); + bt_att_cancel_all(att); + bt_att_ref(att); att->in_disconn = true; queue_foreach(att->disconn_list, disconn_handler, NULL); @@ -565,9 +567,7 @@ static bool disconnect_cb(struct io *io, void *user_data) att->need_disconn_cleanup = false; } - bt_att_cancel_all(att); bt_att_unregister_all(att); - bt_att_unref(att); return false; -- 2.47.3