2011-03-02 09:44:57

by Szymon Janc

Subject: [PATCH] Fix adapter reference count in input plugin

Adapter unref was called on driver removal even if input server failed
to start on probe and reference was not incremented. This leads to
segmentation fault while removing adapter.
---
input/manager.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/input/manager.c b/input/manager.c
index a98a080..259aef7 100644
--- a/input/manager.c
+++ b/input/manager.c
@@ -143,6 +143,9 @@ static void hid_server_remove(struct btd_adapter *adapter)
{
bdaddr_t src;

+ if (!g_slist_find(adapters, adapter))
+ return;
+
adapter_get_address(adapter, &src);

server_stop(&src);
--
1.7.0.4
on behalf of ST-Ericsson

2011-03-04 19:02:17

by Szymon Janc

Subject: Re: [PATCH] Fix adapter reference count in input plugin

> This one looks like it's working around the core issue instead of fixing
> it. The _remove function shouldn't get called if _probe failed. I.e. the
> issue seems to be somewhere in the core daemon.

Every btd_adapter_driver do that so I just followed.

But I agree that proper fix should be in core daemon i.e. flag in
btd_adapter_driver structure and set/test in load/unload_driver in adapter.c
or a separate list of activated drivers.

--
BR
Szymon Janc

2011-03-04 18:38:26

by Johan Hedberg

Subject: Re: [PATCH] Fix adapter reference count in input plugin

Hi Szymon,

On Wed, Mar 02, 2011, Szymon Janc wrote:
> Adapter unref was called on driver removal even if input server
> failed to start on probe and reference was not incremented. This leads
> to segmentation fault while removing adapter.
> ---
> input/manager.c | 3 +++
> 1 files changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/input/manager.c b/input/manager.c
> index a98a080..259aef7 100644
> --- a/input/manager.c
> +++ b/input/manager.c
> @@ -143,6 +143,9 @@ static void hid_server_remove(struct btd_adapter *adapter)
> {
> bdaddr_t src;
>
> + if (!g_slist_find(adapters, adapter))
> + return;
> +
> adapter_get_address(adapter, &src);
>
> server_stop(&src);

This one looks like it's working around the core issue instead of fixing
it. The _remove function shouldn't get called if _probe failed. I.e. the
issue seems to be somewhere in the core daemon.

Johan