Crash in g_hash_table_iter_next() accessing already disposed hash tables
The backtrace looks like this:
0x00007c3594eb3b93 (libglib-2.0.so.0 - ghash.c: 1180) g_hash_table_iter_next
0x00005b60d86f2563 (ModemManager - mm-base-modem.c: 1133) mm_base_modem_get_port_infos
0x00005b60d870228e (ModemManager - mm-iface-modem.c: 4013) fcc_unlock
0x00007c35950126a8 (libgio-2.0.so.0 - gtask.c: 1230) g_task_return_now
0x00007c35950116fa (libgio-2.0.so.0 - gtask.c: 1300) g_task_return
0x00007c3595011d12 (libgio-2.0.so.0 - gtask.c: 1930) g_task_return_new_error
0x00005b60d87518f2 (ModemManager - mm-broadband-modem-mbim.c: 1970) radio_state_set_up_ready
0x00007c35950126a8 (libgio-2.0.so.0 - gtask.c: 1230) g_task_return_now
0x00007c35950116fa (libgio-2.0.so.0 - gtask.c: 1300) g_task_return
0x00007c35950c486c (libmbim-glib.so.4 - mbim-device.c: 253) transaction_task_complete_and_free
0x00007c35950c714b (libmbim-glib.so.4 - mbim-device.c: 335) transaction_timed_out
0x00007c3594ec1232 (libglib-2.0.so.0 - gmain.c: 4971) g_timeout_dispatch
0x00007c3594ec43fc (libglib-2.0.so.0 - gmain.c: 3417) g_main_context_dispatch
0x00007c3594ec4704 (libglib-2.0.so.0 - gmain.c: 4211) g_main_context_iterate
0x00007c3594ec4978 (libglib-2.0.so.0 - gmain.c: 4411) g_main_loop_run
0x00005b60d86d7c56 (ModemManager - main.c: 217) main
0x00007c3594c526c5 (libc.so.6 + 0x000286c5) __libc_init_first
0x00007c3594c52781 (libc.so.6 + 0x00028781) __libc_start_main
0x00005b60d86d7970 (ModemManager + 0x00061970) _start
0x00007fff5ae4fb47
A long-running modem_power_up()
operation in a MBIM modem that ends up timing out after 20s triggers this crash because all modem ports had already gone away due to a modem firmware crash. After that timeout failure we attempt to run FCC unlock because the power up had failed, and that calls mm_base_modem_get_port_infos()
, which is the one attempting the NULL hash table iteration.