eeadab36e1
bug: v/88938 When acting as A2DP ACP, if the remote side disconnects ACL right after Set Configuration (before media channel is established), a2dp_info->stream is freed in a2dp_info_destroy() while zblue's ep->stream still references the same memory. The subsequent avdtp_release_work() then accesses freed memory (use-after-free). Fix by deferring a2dp_info cleanup in zblue_on_disconnected() when stream is still alive. The cleanup is completed later in zblue_on_stream_released() after zblue finishes its release work. Also guard DISCONNECTED_EVT in zblue_on_stream_released() to only fire when media channel was actually established, avoiding duplicate events with zblue_on_disconnected(). Add debug logging to a2dp_info_destroy, zblue_on_stream_configured, zblue_on_stream_released, and zblue_on_disconnected for easier diagnosis. Signed-off-by: Lu Jia <jialu@xiaomi.com> |
||
|---|---|---|
| .. | ||
| common | ||
| ipc | ||
| profiles | ||
| src | ||
| stacks | ||
| utils | ||
| vendor | ||
| vhal | ||