shared-qmi: fix UAF on duplicate list-configs indications

Disconnect the 'list-configs' indication handler immediately inside the
callback. If the modem sends a duplicate indication before the whole
config load sequence completes, it could overwrite the stored
'get-config-info' signal handler ID, orphaning the old handler and
leading to a Use-After-Free when the GTask is completed and the
orphaned handler eventually fires.

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1071

Signed-off-by: Aleksander Morgado <aleksandermj@google.com>

src/mm-shared-qmi.c

@@ -3111,6 +3111,12 @@ list_configs_indication (QmiClientPdc                      *client,
     self = g_task_get_source_object (task);
     ctx  = g_task_get_task_data (task);
 
+    /* Disconnect list-configs indication right away to avoid re-entry */
+    if (ctx->list_configs_indication_id) {
+        g_signal_handler_disconnect (ctx->client, ctx->list_configs_indication_id);
+        ctx->list_configs_indication_id = 0;
+    }
+
     if (!qmi_indication_pdc_list_configs_output_get_indication_result (output, &error_code, &error)) {
         load_carrier_config_abort (task, error);
         return;