Reference PAN network before disconnecting

The PAN network can be destructed before getting the disconnect reply. In
that case disconnect_reply() will segfault by calling
connman_network_set_connected() with a NULL network pointer.
This issue is fixed by referencing the PAN network from pan_disconnect().

diff --git a/plugins/bluetooth.c b/plugins/bluetooth.c
index cec5e64..ee91b7f 100644 (file)
--- a/plugins/bluetooth.c
+++ b/plugins/bluetooth.c
@@ -188,6 +188,8 @@ done:
        dbus_message_unref(reply);
 
        dbus_pending_call_unref(call);
+
+       connman_network_unref(network);
 }
 
 static int pan_disconnect(struct connman_network *network)
@@ -223,6 +225,8 @@ static int pan_disconnect(struct connman_network *network)
                return -EINVAL;
        }
 
+       connman_network_ref(network);
+
        dbus_pending_call_set_notify(call, disconnect_reply, network, NULL);
 
        dbus_message_unref(message);