When the input request has timed out or some other error has occurred do not allow to send duplicate D-Bus error replies. This would result in crashes when hidden network is first informed with ETIMEDOUT and error is returned and if the __connman_device_request_hidden_scan() reports an error or that it is already running (EALREADY) and then second error reply is sent. After each reply to pending D-Bus message (reply_pending()) the service->pending is set NULL but since request_input_cb() holds the reference to the pending D-Bus message (user_data) there will be a second reply. This fixes the issue by 1) recording the error also when D-Bus error is other than Canceled to prevent connecting attempt at done label and 2) skipping hidden network connect in such case as well. --- src/service.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/service.c b/src/service.c index f71a3de7..6f467eaf 100644 --- a/src/service.c +++ b/src/service.c @@ -5666,12 +5666,15 @@ static void request_input_cb(struct connman_service *service, __connman_service_return_error(service, ECONNABORTED, user_data); - goto done; } else { + err = -ETIMEDOUT; + if (service->hidden) __connman_service_return_error(service, ETIMEDOUT, user_data); } + + goto done; } if (service->hidden && name_len > 0 && name_len <= 32) { -- 2.20.1