Fix HID channel reference count issues
This patch cleans up the reference counting of the HID control and
interrupt channels. Particularly the connection failure cases weren't
properly handled previously.
Based on the original report and patch from Jaikumar Ganesh.
diff --git a/input/device.c b/input/device.c
index 5cb57ea..554f5ac 100644
--- a/input/device.c
+++ b/input/device.c
@@ -808,8 +808,6 @@
if (conn_err) {
err_msg = conn_err->message;
- g_io_channel_unref(iconn->intr_io);
- iconn->intr_io = NULL;
goto failed;
}
@@ -832,14 +830,18 @@
reply = btd_error_failed(iconn->pending_connect, err_msg);
g_dbus_send_message(idev->conn, reply);
- if (iconn->ctrl_io)
- g_io_channel_shutdown(iconn->ctrl_io, FALSE, NULL);
+ /* So we guarantee the interrupt channel is closed before the
+ * control channel (if we only do unref GLib will close it only
+ * after returning control to the mainloop */
+ if (!conn_err)
+ g_io_channel_shutdown(iconn->intr_io, FALSE, NULL);
- if (iconn->intr_io) {
- if (!conn_err)
- g_io_channel_shutdown(iconn->intr_io, FALSE, NULL);
- g_io_channel_unref(iconn->intr_io);
- iconn->intr_io = NULL;
+ g_io_channel_unref(iconn->intr_io);
+ iconn->intr_io = NULL;
+
+ if (iconn->ctrl_io) {
+ g_io_channel_unref(iconn->ctrl_io);
+ iconn->ctrl_io = NULL;
}
}
@@ -872,7 +874,6 @@
reply = btd_error_failed(iconn->pending_connect,
err->message);
g_error_free(err);
- g_io_channel_shutdown(chan, TRUE, NULL);
goto failed;
}
@@ -881,6 +882,8 @@
return;
failed:
+ g_io_channel_unref(iconn->ctrl_io);
+ iconn->ctrl_io = NULL;
g_dbus_send_message(idev->conn, reply);
dbus_message_unref(iconn->pending_connect);
iconn->pending_connect = NULL;
