SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ifaces: fix UAFs in signal handlers when hot-unplugging

Browse Source 
Use g_signal_connect_object() to connect to child list/object signals
in the 3GPP, Messaging, Voice, and Cell Broadcast interfaces.

Passing the raw D-Bus skeleton pointer as user_data to these signals
can lead to a Use-After-Free if the skeleton is disposed of (e.g. on
hot-unplug) while the parent object or child list survives. By using
g_signal_connect_object(), the signal handlers are automatically
disconnected when the D-Bus skeleton is destroyed.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1068

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>
This commit is contained in:
Aleksander Morgado
2026-07-10 15:00:07 +02:00
committed by Aleksander Morgado
parent 0280bbae3b
commit 2b1aaca4a0
4 changed files with 35 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mm-iface-modem-3gpp.c
+5 -4
View File
@@ -3713,10 +3713,11 @@ load_enabled_facility_locks_ready (MMIfaceModem3gpp *self,
g_object_get (self, MM_IFACE_MODEM_SIM, &sim, NULL);
if (sim)
g_signal_connect (sim,
MM_BASE_SIM_PIN_LOCK_ENABLED,
G_CALLBACK (sim_pin_lock_enabled_cb),
ctx->skeleton);
g_signal_connect_object (sim,
MM_BASE_SIM_PIN_LOCK_ENABLED,
G_CALLBACK (sim_pin_lock_enabled_cb),
ctx->skeleton,
0);
}
/* Go on to next step */
src/mm-iface-modem-cell-broadcast.c
+10 -8
View File
@@ -636,14 +636,16 @@ interface_enabling_step (GTask *task)
NULL);
/* Connect to list's signals */
g_signal_connect (list,
MM_CBM_ADDED,
G_CALLBACK (cbm_added),
ctx->skeleton);
g_signal_connect (list,
MM_CBM_DELETED,
G_CALLBACK (cbm_deleted),
ctx->skeleton);
g_signal_connect_object (list,
MM_CBM_ADDED,
G_CALLBACK (cbm_added),
ctx->skeleton,
0);
g_signal_connect_object (list,
MM_CBM_DELETED,
G_CALLBACK (cbm_deleted),
ctx->skeleton,
0);
ctx->step++;
} /* fall through */
src/mm-iface-modem-messaging.c
+10 -8
View File
@@ -1026,14 +1026,16 @@ interface_enabling_step (GTask *task)
NULL);
/* Connect to list's signals */
g_signal_connect (list,
MM_SMS_ADDED,
G_CALLBACK (sms_added),
ctx->skeleton);
g_signal_connect (list,
MM_SMS_DELETED,
G_CALLBACK (sms_deleted),
ctx->skeleton);
g_signal_connect_object (list,
MM_SMS_ADDED,
G_CALLBACK (sms_added),
ctx->skeleton,
0);
g_signal_connect_object (list,
MM_SMS_DELETED,
G_CALLBACK (sms_deleted),
ctx->skeleton,
0);
g_object_unref (list);
src/mm-iface-modem-voice.c
+10 -8
View File
@@ -3019,14 +3019,16 @@ interface_initialization_step (GTask *task)
NULL);
/* Connect to list's signals */
g_signal_connect (list,
MM_CALL_ADDED,
G_CALLBACK (call_added),
ctx->skeleton);
g_signal_connect (list,
MM_CALL_DELETED,
G_CALLBACK (call_deleted),
ctx->skeleton);
g_signal_connect_object (list,
MM_CALL_ADDED,
G_CALLBACK (call_added),
ctx->skeleton,
0);
g_signal_connect_object (list,
MM_CALL_DELETED,
G_CALLBACK (call_deleted),
ctx->skeleton,
0);
/* Setup monitoring for in-call event handling */
g_signal_connect (list,