Unreference the service that has been stored in the connman_wpad structure
when calling __connman_wpad_stop() instead of the service given in the
function argument. This ensures that if two services point to the same
interface index, the one referenced by wpad code is the one that gets
unreferenced.
This may be related to the reported segfault with reference count going to
zero while processing connect_timeout().
---
src/wpad.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/src/wpad.c b/src/wpad.c
index d40959b..f066fee 100644
--- a/src/wpad.c
+++ b/src/wpad.c
@@ -49,6 +49,8 @@ static void free_wpad(gpointer data)
{
struct connman_wpad *wpad = data;
+ connman_service_unref(wpad->service);
+
g_resolv_unref(wpad->resolv);
g_strfreev(wpad->addrlist);
@@ -152,7 +154,6 @@ int __connman_wpad_start(struct connman_service *service)
return -ENOMEM;
}
- wpad->service = service;
wpad->resolv = g_resolv_new(index);
if (!wpad->resolv) {
g_strfreev(nameservers);
@@ -172,10 +173,11 @@ int __connman_wpad_start(struct connman_service *service)
DBG("hostname %s", wpad->hostname);
+ wpad->service = connman_service_ref(service);
+
g_resolv_lookup_hostname(wpad->resolv, wpad->hostname,
wpad_result, wpad);
- connman_service_ref(service);
g_hash_table_replace(wpad_list, GINT_TO_POINTER(index), wpad);
return 0;
@@ -194,8 +196,7 @@ void __connman_wpad_stop(struct connman_service *service)
if (index < 0)
return;
- if (g_hash_table_remove(wpad_list, GINT_TO_POINTER(index)))
- connman_service_unref(service);
+ g_hash_table_remove(wpad_list, GINT_TO_POINTER(index));
}
int __connman_wpad_init(void)
--
2.1.4
_______________________________________________
connman mailing list
[email protected]
https://lists.connman.net/mailman/listinfo/connman
