Skip to content

[th/libnm-dangling-property-2] libnm: fix dangling pointer in "o" properties when unregistering NMObject

Thomas Haller requested to merge th/libnm-dangling-property-2 into main

When NMClient gets destroyed, it unrefs all NMObject. We need to unbreak cycles then, and the property getters must return NULL. In particular, for "o" type properties (NMLDBusPropertyO), this was not done correctly. For example, calling nm_device_get_active_connection() while/after destroying the NMClient can give a dangling pointer and assertion failure. This will also be covered by test_activate_virtual(). Probably a similar issue can happen, when a D-Bus object gets removed (without destroying NMClient altogether).

The fix is that nml_dbus_property_o_clear() needs to clear "nmobj". That is correct, because the pointer is no longer valid and should not be there. And the unit test shows that in fact a pointer is left there, and clearing it fixes it.

That was different from an earlier attempt to fix this (in commit 62b2aa85 ('Revert "libnm: fix dangling pointer in public API while destructing NMClient"')), where clearing the pointer at a different place broke things. That attempt was wrong, because nml_dbus_property_o_notify_changed() needs to be the one that sets/clears nmobj field during a regular update. But the case here is not a regular update, nml_dbus_property_o_clear() happens during unregister/cleanup, and then we need to clear the pointer.

Fixes: ce0e898f ('libnm: refactor caching of D-Bus objects in NMClient')

Merge request reports