SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge request !1509 from 'netlink-completion-use-after-free'

Browse Source 
netlink: fix use-after-free calling completion_fn on transaction completion

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1509
This commit is contained in:
Dan Williams
2026-10-04 23:10:41 -05:00
parent b422bd58ef 9317cbc470
commit 7f0bf17ab5
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mm-netlink.c
+6 -3
View File
@@ -227,11 +227,14 @@ transaction_complete (Transaction *tr,
struct nlmsghdr *hdr,
gint saved_errno)
{
GTask *task;
guint32 sequence_id;
GTask *task;
guint32 sequence_id;
MsgFunc completion_fn;
/* tr is freed by hashtable remove; cache values we need after */
task = g_steal_pointer (&tr->completion_task);
sequence_id = tr->sequence_id;
completion_fn = tr->completion_fn;
g_hash_table_remove (tr->self->transactions,
GUINT_TO_POINTER (tr->sequence_id));
@@ -239,7 +242,7 @@ transaction_complete (Transaction *tr,
if (!saved_errno) {
GError *error = NULL;
if (!tr->completion_fn (task, hdr, &error))
if (!completion_fn (task, hdr, &error))
g_task_return_error (task, error);
} else {
g_task_return_new_error (task, G_IO_ERROR, g_io_error_from_errno (saved_errno),