Clean up properly if stream starting fails

Remove the stream state callback if stream start fails. Without this patch the
callback could still be called after a unix client has disconnected which in
turn would cause a double-free to occur. There is code to remove the callback
also in client_free() but it won't work since we remove any references to the
session and stream in the resume callback.

1 files changed, 6 insertions, 0 deletions

diff --git a/audio/unix.c b/audio/unix.c
index 5d5ab206..141a2b10 100644
--- a/audio/unix.c
+++ b/audio/unix.c
@@ -515,6 +515,12 @@ failed:
 	}
 	unix_ipc_error(client, BT_STREAMSTART_RSP, EIO);
 
+	if (client->cb_id > 0) {
+		avdtp_stream_remove_cb(a2dp->session, a2dp->stream,
+					client->cb_id);
+		client->cb_id = 0;
+	}
+
 	avdtp_unref(a2dp->session);
 
 	a2dp->session = NULL;