From: Martin Xu <martin.xu@intel.com>
Date: Fri, 9 Apr 2010 08:06:47 +0000 (+0800)
Subject: Reference PAN network before disconnecting
X-Git-Tag: 2.0_alpha~2793
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=67f5b07184ee3ebb9763a260dd622d51b75b04f4;p=framework%2Fconnectivity%2Fconnman.git

Reference PAN network before disconnecting

The PAN network can be destructed before getting the disconnect reply. In
that case disconnect_reply() will segfault by calling
connman_network_set_connected() with a NULL network pointer.
This issue is fixed by referencing the PAN network from pan_disconnect().
---

diff --git a/plugins/bluetooth.c b/plugins/bluetooth.c
index cec5e64..ee91b7f 100644
--- a/plugins/bluetooth.c
+++ b/plugins/bluetooth.c
@@ -188,6 +188,8 @@ done:
 	dbus_message_unref(reply);
 
 	dbus_pending_call_unref(call);
+
+	connman_network_unref(network);
 }
 
 static int pan_disconnect(struct connman_network *network)
@@ -223,6 +225,8 @@ static int pan_disconnect(struct connman_network *network)
 		return -EINVAL;
 	}
 
+	connman_network_ref(network);
+
 	dbus_pending_call_set_notify(call, disconnect_reply, network, NULL);
 
 	dbus_message_unref(message);