Skip to content

[th/libnm-dangling-property] libnm: fix dangling pointer in public API while destructing NMClient

Thomas Haller requested to merge th/libnm-dangling-property into main

While (and after) NMClient gets destroyed, nm_device_get_active_connection() gives a dangling pointer. That can lead to a crash. This probably affects all NMLDBusPropertyO type properties.

It's not clear how to fix that best. Usually, NMClient does updates in two phases, first it processes the D-Bus events and tracks internal data, then it emits all GObject signals and notifications.

When an object gets removed from the NMClient cache, then the second phase is not fully processed, because the object is already removed from the cache. Thus, the property was not properly cleared leaving a dangling pointer.

A simple fix is to always clear the pointer during the first phase. Note that effectively we do the same also for NMLDBusPropertyAO (by clearing the "pr_ao->arr"), so at least this is consistent.

Somehow it seems that we should make sure that the "second" phase gets full processed in this case too. But it's complicated, and it's not clear how to do that. So this solution seems fine.

https://bugzilla.redhat.com/show_bug.cgi?id=2039331 #896 (closed)

Merge request reports