a2dp: Fix ref counting bug of setup_unref
authorSonny Sasaka <sonnysasaka@chromium.org>
Sat, 30 May 2020 08:51:18 +0000 (01:51 -0700)
committerAyush Garg <ayush.garg@samsung.com>
Mon, 12 Apr 2021 09:00:49 +0000 (14:30 +0530)
In a2dp_reconfig, setup is ref-counted by cb_data. However, in the fail
label setup is unref-ed but cb_data is not cleared. This may cause
double unref in the future if cb_data gets executed. Instead, we should
do setup_cb_free to clear cb_data and unref setup.

Signed-off-by: Anuj Jain <anuj01.jain@samsung.com>
Signed-off-by: Ayush Garg <ayush.garg@samsung.com>
profiles/audio/a2dp.c

index 9956160..4251a47 100644 (file)
@@ -1809,7 +1809,7 @@ static int a2dp_reconfig(struct a2dp_channel *chan, const char *sender,
        return 0;
 
 fail:
-       setup_unref(setup);
+       setup_cb_free(cb_data);
        return err;
 }