linux-platform: fix crash in _new_from_nl_link() when sharing lnk data

We want to reuse an existing (equal) lnk-data from the cache.

  NetworkManager[20977]: <debug> [1460993609.1427] platform: signal: link   added: 11: qib_ib0.8002@4 <UP,LOWER_UP;broadcast,multicast,up,running,lowerup> mtu 65520 arp 32 infiniband? not-init addrgenmode eui64 addr 80:00:00:11:FE:80:00:00:00:00:00:00:00:11:75:00:00:6F:33:DE driver ib_ipoib
  ...
  NetworkManager[20977]: <debug> [1460993609.1467] platform-linux: do-request-link: 11
  NetworkManager[20977]: nmp_object_ref: assertion 'NMP_OBJECT_IS_VALID (obj)' failed

  Program received signal SIGTRAP, Trace/breakpoint trap.
  g_logv (log_domain=0x55555583dcce "NetworkManager", log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, args=args@entry=0x7fffffffc8e0) at gmessages.c:1046
  1046              g_private_set (&g_log_depth, GUINT_TO_POINTER (depth));
  (gdb) bt
  #0  0x00002aaaad94b8c3 in g_logv (log_domain=0x55555583dcce "NetworkManager", log_level=G_LOG_LEVEL_CRITICAL, format=<optimized out>, args=args@entry=0x7fffffffc8e0) at gmessages.c:1046
  #1  0x00002aaaad94ba3f in g_log (log_domain=<optimized out>, log_level=<optimized out>, format=<optimized out>) at gmessages.c:1079
  #2  0x00005555557863be in nmp_object_ref (obj=0x0) at platform/nmp-object.c:210
  #3  0x0000555555624c0e in event_handler_recvmsgs (id_only=<optimized out>, nlh=<optimized out>, cache=<optimized out>, platform=<optimized out>) at platform/nm-linux-platform.c:1568
  #4  0x0000555555624c0e in event_handler_recvmsgs (id_only=<optimized out>, msg=0x555555b0ebf0, cache=<optimized out>, platform=<optimized out>) at platform/nm-linux-platform.c:1923
  #5  0x0000555555624c0e in event_handler_recvmsgs (handle_events=<optimized out>, msg=0x555555b0ebf0, platform=<optimized out>) at platform/nm-linux-platform.c:3656
  #6  0x0000555555624c0e in event_handler_recvmsgs (platform=platform@entry=0x555555b00980 [NMLinuxPlatform], handle_events=handle_events@entry=1) at platform/nm-linux-platform.c:5886
  #7  0x0000555555626857 in event_handler_read_netlink (platform=platform@entry=0x555555b00980 [NMLinuxPlatform], wait_for_acks=wait_for_acks@entry=0) at platform/nm-linux-platform.c:5942
  #8  0x0000555555627093 in do_request_link_no_delayed_actions (platform=platform@entry=0x555555b00980 [NMLinuxPlatform], ifindex=ifindex@entry=11, name=name@entry=0x0) at platform/nm-linux-platform.c:3480
  #9  0x00005555556273d6 in delayed_action_handle_all (ifindex=11, platform=0x555555b00980 [NMLinuxPlatform]) at platform/nm-linux-platform.c:2918
  #10 0x00005555556273d6 in delayed_action_handle_all (platform=0x555555b00980 [NMLinuxPlatform]) at platform/nm-linux-platform.c:3003
  #11 0x00005555556273d6 in delayed_action_handle_all (platform=0x555555b00980 [NMLinuxPlatform], read_netlink=<optimized out>) at platform/nm-linux-platform.c:3029
  #12 0x000055555562a33f in constructed (_object=<optimized out>) at platform/nm-linux-platform.c:6241
  #13 0x00002aaaad6c0292 in g_object_new_internal (class=class@entry=0x555555b12ef0, params=params@entry=0x7fffffffd660, n_params=2) at gobject.c:1814
  #14 0x00002aaaad6c21d4 in g_object_new_valist (object_type=object_type@entry=93824998249472, first_property_name=first_property_name@entry=0x55555580629e "register-singleton", var_args=var_args@entry=0x7fffffffd7b0) at gobject.c:2034
  #15 0x00002aaaad6c25d1 in g_object_new (object_type=93824998249472, first_property_name=0x55555580629e "register-singleton") at gobject.c:1617
  #16 0x00005555555d1798 in main (argc=1, argv=0x7fffffffda58) at main.c:446

Fixes: db5d00d396
This commit is contained in:
Thomas Haller
2016-04-18 17:53:08 +02:00
parent f439f05237
commit 201d91115c

View File

@@ -1562,6 +1562,7 @@ _new_from_nl_link (NMPlatform *platform, const NMPCache *cache, struct nlmsghdr
_lookup_cached_link (cache, obj->link.ifindex, completed_from_cache, &link_cached);
if ( link_cached
&& link_cached->link.type == obj->link.type
&& link_cached->_link.netlink.lnk
&& ( !lnk_data
|| nmp_object_equal (lnk_data, link_cached->_link.netlink.lnk))) {
nmp_object_unref (lnk_data);