[PATCH] service: Hold a reference to the service while disconnecting

[Slava Monich]

Otherwise it could be deallocated by __connman_network_disconnect
meaning that all subsequent references to it will access freed memory
---
 src/service.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/service.c b/src/service.c
index 9bba227..7e6cd7a 100644
--- a/src/service.c
+++ b/src/service.c
@@ -127,6 +127,7 @@ struct connman_service {
 };
 
 static bool allow_property_changed(struct connman_service *service);
+static int service_disconnect(struct connman_service *service);
 
 static struct connman_ipconfig *create_ip4config(struct connman_service 
*service,
                int index, enum connman_ipconfig_method method);
@@ -4616,7 +4617,7 @@ void connman_service_unref_debug(struct connman_service 
*service,
 
        service_list = g_list_remove(service_list, service);
 
-       __connman_service_disconnect(service);
+       service_disconnect(service);
 
        g_hash_table_remove(service_hash, service->identifier);
 }
@@ -6020,7 +6021,7 @@ int __connman_service_connect(struct connman_service 
*service,
        return err;
 }
 
-int __connman_service_disconnect(struct connman_service *service)
+static int service_disconnect(struct connman_service *service)
 {
        int err;
 
@@ -6067,6 +6068,17 @@ int __connman_service_disconnect(struct connman_service 
*service)
        return err;
 }
 
+int __connman_service_disconnect(struct connman_service *service)
+{
+       int err;
+
+       connman_service_ref(service);
+       err = service_disconnect(service);
+       connman_service_unref(service);
+
+       return err;
+}
+
 int __connman_service_disconnect_all(void)
 {
        struct connman_service *service;
-- 
1.8.3.2

_______________________________________________
connman mailing list
connman@connman.net
https://lists.connman.net/mailman/listinfo/connman