Bluetooth: ISO: Fix crash when channel has already been disconnected

If chan->conn is already NULL do not call bt_conn_unref as that will
likely cause a crash, also this make sure that if channel has been
disconnected using bt_iso_chan_disconnect it removes the channel from
connection list before setting the chan->conn to NULL.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2020-10-28 11:33:27 -07:00 committed by Johan Hedberg
parent 385000e8d9
commit 09e95a26a4

View File

@ -742,8 +742,11 @@ void bt_iso_disconnected(struct bt_conn *conn)
chan->ops->disconnected(chan);
}
bt_conn_unref(chan->conn);
chan->conn = NULL;
if (chan->conn) {
bt_conn_unref(chan->conn);
chan->conn = NULL;
}
bt_iso_chan_set_state(chan, BT_ISO_DISCONNECTED);
}
}
@ -930,6 +933,7 @@ int bt_iso_chan_disconnect(struct bt_iso_chan *chan)
if (chan->state == BT_ISO_BOUND) {
bt_iso_chan_set_state(chan, BT_ISO_DISCONNECTED);
bt_iso_chan_remove(chan->conn, chan);
bt_conn_unref(chan->conn);
chan->conn = NULL;
return 0;