Skip to content

sleep-monitor: fix possible use-after-free on shutdown

Dan Williams requested to merge dcbw/ModemManager:sleep-monitor-unref-fix into main 
ModemManager[11175]: <msg> [1730903908.413325] ModemManager is shut down
ModemManager[11175]: <dbg> [1730903908.419095] [sleep-monitor-systemd] singleton disposed
ModemManager[11175]: <dbg> [1730903908.420331] [sleep-monitor-systemd] dropping systemd sleep inhibitor
ModemManager[11175]: <dbg> [1730903908.438136] [modem setup dispatcher] singleton disposed
==11175== Invalid read of size 8
==11175==    at 0x4C37B04: g_dbus_connection_signal_unsubscribe (gdbusconnection.c:4125)
==11175==    by 0x4C4DCE0: g_dbus_proxy_finalize (gdbusproxy.c:200)
==11175==    by 0x4D26B69: g_object_unref (gobject.c:4484)
==11175==    by 0x5673F2D: polkit_authority_finalize (polkitauthority.c:161)
==11175==    by 0x4D26B69: g_object_unref (gobject.c:4484)
==11175==    by 0x45F6F5: dispose (mm-auth-provider.c:200)
==11175==    by 0x4D26A77: g_object_unref (gobject.c:4413)
==11175==    by 0x45F90D: _singleton_destructor (mm-auth-provider.c:220)
==11175==    by 0x40010F1: _dl_call_fini (dl-call_fini.c:43)
==11175==    by 0x400526D: _dl_fini (dl-fini.c:114)
==11175==    by 0x56CD3A0: __run_exit_handlers (in /usr/lib64/libc.so.6)
==11175==    by 0x56CD46D: exit (in /usr/lib64/libc.so.6)
==11175==  Address 0x5c48a00 is 0 bytes inside a block of size 256 free'd
==11175==    at 0x4846B83: free (vg_replace_malloc.c:989)
==11175==    by 0x4A44D04: g_free_sized (gmem.c:238)
==11175==    by 0x4D3CAE1: g_type_free_instance (gtype.c:2030)
==11175==    by 0x4D26B75: g_object_unref (gobject.c:4500)
==11175==    by 0x4C4DC43: g_dbus_proxy_finalize (gdbusproxy.c:212)
==11175==    by 0x4D26B69: g_object_unref (gobject.c:4484)
==11175==    by 0x4FA4C1: finalize (mm-sleep-monitor-systemd.c:224)
==11175==    by 0x4D26B69: g_object_unref (gobject.c:4484)
==11175==    by 0x4FA77E: _singleton_destructor (mm-sleep-monitor-systemd.c:263)
==11175==    by 0x40010F1: _dl_call_fini (dl-call_fini.c:43)
==11175==    by 0x400526D: _dl_fini (dl-fini.c:114)
==11175==    by 0x56CD3A0: __run_exit_handlers (in /usr/lib64/libc.so.6)
==11175==  Block was alloc'd at
==11175==    at 0x484B133: calloc (vg_replace_malloc.c:1675)
==11175==    by 0x4A4B871: g_malloc0 (gmem.c:133)
==11175==    by 0x4D43BC5: g_type_create_instance (gtype.c:1933)
==11175==    by 0x4D29003: g_object_new_internal.part.0 (gobject.c:2606)
==11175==    by 0x4D2B27A: UnknownInlinedFun (gobject.c:2923)
==11175==    by 0x4D2B27A: g_object_new_valist (gobject.c:2945)
==11175==    by 0x4D2B61E: g_object_new (gobject.c:2418)
==11175==    by 0x4C448CF: get_uninitialized_connection (gdbusconnection.c:7835)
==11175==    by 0x4C44B35: g_bus_get (gdbusconnection.c:8001)
==11175==    by 0x4C49FD6: g_bus_own_name (gdbusnameowning.c:676)
==11175==    by 0x45EEB2: main (main.c:206)

Make sure we clean up our internal private data rather than just freeing it and leaving the useless pointer there.

Signed-off-by: Dan Williams dan@ioncontrol.co

Merge request reports