Skip to content

bluetooth: Fix crash when disabling Bluetooth adapter

This crash occurs when PA is connected to a phone through the oFono backend. When disabling the Bluetooth adapter, pa_bluetooth_device is removed before hf_audio_card. Both keep refs on pa_bluetooth_transport. Those removal will call pa_bluetooth_transport_free() from device_free() (bluez5-util.c) and hf_audio_card_free() (backend-ofono.c). In the end, the call to pa_bluetooth_transport_free() calls pa_hasmap_remove() through pa_bluetooth_transport_unlink(), but since memory has already been freed, the second try results in a segfault.

Triggering hf_audio_card removal during pa_bluetooth_device removal allows hf_audio_card to be freed at the right time.

Merge request reports