From c3e7ffaae04ae6ff9e810093ca1c102a5572e6be Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Thu, 2 Jul 2026 17:39:30 +0000 Subject: [PATCH] plugins: fix GError double-frees when returning errors from tasks Use g_steal_pointer() when passing g_autoptr(GError) to g_task_return_error() to prevent double-free by the automatic cleanup. GTask takes ownership of the passed GError. If we use g_autoptr(GError) locally, it will also call g_error_free() when the function returns, causing a double-free / heap corruption. Stealing the pointer clears the local variable and prevents the automatic cleanup. https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/work_items/1073 Signed-off-by: Aleksander Morgado --- src/plugins/cinterion/mm-broadband-modem-cinterion.c | 8 ++++---- src/plugins/cinterion/mm-shared-cinterion.c | 4 ++-- src/plugins/fibocom/mm-shared-fibocom.c | 2 +- src/plugins/foxconn/mm-broadband-modem-mbim-foxconn.c | 2 +- src/plugins/quectel/mm-broadband-modem-quectel.c | 2 +- src/plugins/quectel/mm-shared-quectel.c | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/plugins/cinterion/mm-broadband-modem-cinterion.c b/src/plugins/cinterion/mm-broadband-modem-cinterion.c index 3d70cf50..e0cd82d4 100644 --- a/src/plugins/cinterion/mm-broadband-modem-cinterion.c +++ b/src/plugins/cinterion/mm-broadband-modem-cinterion.c @@ -1177,7 +1177,7 @@ modem_3gpp_register_in_network (MMIfaceModem3gpp *_self, operator_code, &command, &error)) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } @@ -1723,14 +1723,14 @@ ws46_query_ready (MMBaseModem *self, response = mm_base_modem_at_command_finish (self, res, &error); if (!response) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } if (!mm_cinterion_parse_ws46_response (response, &(result->allowed), &error)) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } @@ -1882,7 +1882,7 @@ cops_set_current_modes (MMBroadbandModemCinterion *self, operator_id, &command, &error)) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } diff --git a/src/plugins/cinterion/mm-shared-cinterion.c b/src/plugins/cinterion/mm-shared-cinterion.c index aa9b6208..3a703a22 100644 --- a/src/plugins/cinterion/mm-shared-cinterion.c +++ b/src/plugins/cinterion/mm-shared-cinterion.c @@ -266,7 +266,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self, priv = get_private (MM_SHARED_CINTERION (self)); update_settings = priv->iface_modem_firmware_parent->load_update_settings_finish (self, res, &error); if (error) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } @@ -276,7 +276,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self, ids = mm_iface_firmware_build_generic_device_ids (MM_IFACE_MODEM_FIRMWARE (self), &error); if (error) { mm_obj_warn (self, "failed to build generic device ids: %s", error->message); - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } diff --git a/src/plugins/fibocom/mm-shared-fibocom.c b/src/plugins/fibocom/mm-shared-fibocom.c index 1f9559c4..9259d080 100644 --- a/src/plugins/fibocom/mm-shared-fibocom.c +++ b/src/plugins/fibocom/mm-shared-fibocom.c @@ -343,7 +343,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self, priv = get_private (MM_SHARED_FIBOCOM (self)); update_settings = priv->iface_modem_firmware_parent->load_update_settings_finish (self, res, &error); if (error) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } diff --git a/src/plugins/foxconn/mm-broadband-modem-mbim-foxconn.c b/src/plugins/foxconn/mm-broadband-modem-mbim-foxconn.c index 9e32df3b..21138c6a 100644 --- a/src/plugins/foxconn/mm-broadband-modem-mbim-foxconn.c +++ b/src/plugins/foxconn/mm-broadband-modem-mbim-foxconn.c @@ -276,7 +276,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self, update_settings = iface_modem_firmware_parent->load_update_settings_finish (self, res, &error); if (error) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } diff --git a/src/plugins/quectel/mm-broadband-modem-quectel.c b/src/plugins/quectel/mm-broadband-modem-quectel.c index 072e291b..dbf8c427 100644 --- a/src/plugins/quectel/mm-broadband-modem-quectel.c +++ b/src/plugins/quectel/mm-broadband-modem-quectel.c @@ -212,7 +212,7 @@ power_off_ready (MMBroadbandModemQuectel *self, */ if (!mm_base_modem_at_command_finish (MM_BASE_MODEM (self), res, &error)) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; } diff --git a/src/plugins/quectel/mm-shared-quectel.c b/src/plugins/quectel/mm-shared-quectel.c index a7bc1341..9d36583f 100644 --- a/src/plugins/quectel/mm-shared-quectel.c +++ b/src/plugins/quectel/mm-shared-quectel.c @@ -485,7 +485,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self, priv = get_private (MM_SHARED_QUECTEL (self)); update_settings = priv->iface_modem_firmware_parent->load_update_settings_finish (self, res, &error); if (error) { - g_task_return_error (task, error); + g_task_return_error (task, g_steal_pointer (&error)); g_object_unref (task); return; }