colin/NetworkManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libnm: fix crash in activate_info_complete() when cancelling

Browse Source 
We must disconnect ActivateInfo before invoking callbacks.

Otherwise, it can happen that the callee cancels the cancellable,
which in turn enters activate_info_complete() again, and leads
to a crash.

https://bugzilla.redhat.com/show_bug.cgi?id=1642625
This commit is contained in:
Thomas Haller
2018-10-25 12:08:47 +02:00
parent ac90593cc2
commit ec37e18c64
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libnm/nm-manager.c
View File

@@ -885,22 +885,20 @@ activate_info_complete (ActivateInfo *info,
NMActiveConnection *active, NMActiveConnection *active,
GError *error) GError *error)
{ {
nm_clear_g_signal_handler (info->cancellable, &info->cancelled_id);
c_list_unlink_stale (&info->lst);
if (active) if (active)
g_simple_async_result_set_op_res_gpointer (info->simple, g_object_ref (active), g_object_unref); g_simple_async_result_set_op_res_gpointer (info->simple, g_object_ref (active), g_object_unref);
else else
g_simple_async_result_set_from_error (info->simple, error); g_simple_async_result_set_from_error (info->simple, error);
g_simple_async_result_complete (info->simple); g_simple_async_result_complete (info->simple);
c_list_unlink_stale (&info->lst);
g_free (info->active_path); g_free (info->active_path);
g_free (info->new_connection_path); g_free (info->new_connection_path);
g_object_unref (info->simple); g_object_unref (info->simple);
if (info->cancellable) { nm_g_object_unref (info->cancellable);
if (info->cancelled_id)
g_signal_handler_disconnect (info->cancellable, info->cancelled_id);
g_object_unref (info->cancellable);
}
g_slice_free (ActivateInfo, info); g_slice_free (ActivateInfo, info);
} }