From 166d6c5bc8da3cc822bebb0e9bb6f24ea0a77aed Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Thu, 2 Jul 2026 17:08:11 +0000 Subject: [PATCH] quectel: fix UAF in RDY URC handler Defer the validity change (which triggers modem reprobe/removal) to an idle callback in rdy_handler(). Calling mm_base_modem_set_valid(FALSE) synchronously from the URC handler triggers the immediate destruction of the modem object while the serial port is still iterating the unsolicited message handlers. Deferring the operation to an idle callback and taking a reference to the modem ensures the modem object is kept alive until parse_unsolicited() has returned. https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1072 Signed-off-by: Aleksander Morgado --- src/plugins/quectel/mm-shared-quectel.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/plugins/quectel/mm-shared-quectel.c b/src/plugins/quectel/mm-shared-quectel.c index 1bae73e4..a7bc1341 100644 --- a/src/plugins/quectel/mm-shared-quectel.c +++ b/src/plugins/quectel/mm-shared-quectel.c @@ -152,6 +152,14 @@ mm_shared_quectel_create_wwan_port (MMBaseModem *self, /*****************************************************************************/ /* RDY unsolicited event handler */ +static gboolean +rdy_handler_idle (MMBroadbandModem *self) +{ + mm_base_modem_set_reprobe (MM_BASE_MODEM (self), TRUE); + mm_base_modem_set_valid (MM_BASE_MODEM (self), FALSE); + return G_SOURCE_REMOVE; +} + static void rdy_handler (MMPortSerialAt *port, GMatchInfo *match_info, @@ -162,8 +170,10 @@ rdy_handler (MMPortSerialAt *port, * re-synchronize modem and ModemManager states by re-probing. */ mm_obj_warn (self, "modem reset detected, triggering reprobe"); - mm_base_modem_set_reprobe (MM_BASE_MODEM (self), TRUE); - mm_base_modem_set_valid (MM_BASE_MODEM (self), FALSE); + g_idle_add_full (G_PRIORITY_DEFAULT_IDLE, + (GSourceFunc) rdy_handler_idle, + g_object_ref (self), + g_object_unref); } /*****************************************************************************/