The crash happens because if gprs_context_remove is called and the subsequent send of a DEACTIVATE_CALL fails, then retry_deactivate is added as a timeout callback. When retry_deactivate is invoked two seconds later, the atom data struct ( gprs_context_data ) has already been freed, so retry_deactivate crashes at: /rilmodem/gprs-context.c:line 348:
The crash happens because if gprs_context_remove is called and the subsequent send of a DEACTIVATE_CALL fails, then retry_deactivate is added as a timeout callback. When retry_deactivate is invoked two seconds later, the atom data struct ( gprs_context_data ) has already been freed, so retry_deactivate crashes at: /rilmodem/ gprs-context. c:line 348:
if (gcd->state == STATE_IDLE) {