Fix agent double free on device removal.

2 files changed, 16 insertions, 15 deletions

diff --git a/hcid/adapter.c b/hcid/adapter.c
index 04fe4c09..71b79d83 100644
--- a/hcid/adapter.c
+++ b/hcid/adapter.c
@@ -3940,15 +3940,6 @@ static DBusHandlerResult find_device(DBusConnection *conn,
 	return send_message_and_unref(conn, reply);
 }
 
-static void agent_exited(const char *name, struct adapter *adapter)
-{
-	debug("Agent %s exited without calling Unregister", name);
-
-	agent_destroy(adapter->agent, TRUE);
-
-	adapter->agent = NULL;
-}
-
 static void agent_removed(struct agent *agent, struct adapter *adapter)
 {
 	if (adapter->agent == agent)
@@ -3985,8 +3976,6 @@ static DBusHandlerResult register_agent(DBusConnection *conn,
 
 	adapter->agent = agent;
 
-	name_listener_add(conn, name, (name_cb_t) agent_exited, adapter);
-
 	return send_message_and_unref(conn, reply);
 }
 
@@ -4010,9 +3999,6 @@ static DBusHandlerResult unregister_agent(DBusConnection *conn,
 	if (!reply)
 		return DBUS_HANDLER_RESULT_NEED_MEMORY;
 
-	name_listener_remove(conn, name, (name_cb_t) agent_exited,
-				adapter);
-
 	agent_destroy(adapter->agent, FALSE);
 	adapter->agent = NULL;
 
diff --git a/hcid/agent.c b/hcid/agent.c
index 318a2ed3..25079908 100644
--- a/hcid/agent.c
+++ b/hcid/agent.c
@@ -127,6 +127,16 @@ static void agent_request_free(struct agent_request *req)
 	g_free(req);
 }
 
+static void agent_exited(const char *name, struct agent *agent)
+{
+	struct adapter *adapter = agent->adapter;
+
+	debug("Agent %s exited without calling Unregister", name);
+
+	agent_destroy(agent, TRUE);
+	adapter->agent = NULL;
+}
+
 static void agent_free(struct agent *agent)
 {
 	if (!agent)
@@ -160,8 +170,11 @@ static void agent_free(struct agent *agent)
 	if (agent->timeout)
 		g_source_remove(agent->timeout);
 
-	if (!agent->exited)
+	if (!agent->exited) {
+		name_listener_remove(connection, agent->name,
+				(name_cb_t) agent_exited, agent);
 		agent_release(agent);
+	}
 
 	g_free(agent->name);
 	g_free(agent->path);
@@ -204,6 +217,8 @@ struct agent *agent_create(struct adapter *adapter, const char *name,
 						(GSourceFunc) agent_timeout, agent);
 	}
 
+	name_listener_add(connection, name, (name_cb_t) agent_exited, agent);
+
 	return agent;
 }