From 00825879155a0c3cb60f1b43cab77df5498b4a93 Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Thu, 10 Sep 2026 14:54:34 +0000 Subject: [PATCH 1/2] bearer-mbim: fix cancellation when waiting for async SLAAC The first argument in the GCallback is actually the GCancellable. 0x00005cf40027c2d3 (ModemManager - mm-bearer-mbim.c: 643) ip_configuration_async_cleanup 0x00005cf40027bfb9 (ModemManager - mm-bearer-mbim.c: 671) ip_configuration_async_cancelled 0x00007feda3a6fb33 (libgobject-2.0.so.0 - gclosure.c: 895) _g_closure_invoke_va 0x00007feda3a87da1 (libgobject-2.0.so.0 - gsignal.c: 3472) g_signal_emit_valist 0x00007feda3a88811 (libgobject-2.0.so.0 - gsignal.c: 3622) g_signal_emit 0x00007feda3b0f98d (libgio-2.0.so.0 - gcancellable.c: 519) g_cancellable_cancel 0x00005cf4001dd8fa (ModemManager - mm-base-bearer.c) modem_3gpp_registration_state_changed 0x00007feda3a6f8d2 (libgobject-2.0.so.0 - gclosure.c: 832) g_closure_invoke 0x00007feda3a8728a (libgobject-2.0.so.0 - gsignal.c: 3812) signal_emit_unlocked_R 0x00007feda3a883d4 (libgobject-2.0.so.0 - gsignal.c: 3565) g_signal_emit_valist 0x00007feda3a88811 (libgobject-2.0.so.0 - gsignal.c: 3622) g_signal_emit 0x00007feda3a7aac2 (libgobject-2.0.so.0 - gobject.c: 1428) g_object_dispatch_properties_changed 0x00007feda3a757b8 (libgobject-2.0.so.0 - gobject.c: 359) g_object_notify_queue_thaw 0x00007feda3a773a9 (libgobject-2.0.so.0 - gobject.c: 2793) g_object_set_valist 0x00007feda3a77db8 (libgobject-2.0.so.0 - gobject.c: 2957) g_object_set 0x00005cf40021492a (ModemManager - mm-iface-modem-3gpp.c: 2347) update_non_registered_state Signed-off-by: Aleksander Morgado --- src/mm-bearer-mbim.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/mm-bearer-mbim.c b/src/mm-bearer-mbim.c index d102f33b..63aebb5a 100644 --- a/src/mm-bearer-mbim.c +++ b/src/mm-bearer-mbim.c @@ -667,7 +667,8 @@ ip_configuration_async_timeout (GTask *task) } static void -ip_configuration_async_cancelled (GTask *task) +ip_configuration_async_cancelled (GCancellable *cancellable, + GTask *task) { ip_configuration_async_cleanup (task); g_task_return_new_error (task, MM_CORE_ERROR, MM_CORE_ERROR_CANCELLED, From 07893109ea9173e191e75380d18162ef45f560b9 Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Thu, 10 Sep 2026 15:34:41 +0000 Subject: [PATCH 2/2] bearer-mbim: avoid deadlock when cancelling async SLAAC logic g_cancellable_disconnect() must not be called from within the cancellable callback, or it will deadlock. Signed-off-by: Aleksander Morgado --- src/mm-bearer-mbim.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/mm-bearer-mbim.c b/src/mm-bearer-mbim.c index 63aebb5a..06e5b77a 100644 --- a/src/mm-bearer-mbim.c +++ b/src/mm-bearer-mbim.c @@ -641,9 +641,10 @@ ip_configuration_async_cleanup (GTask *task) ctx = g_task_get_task_data (task); - g_assert (ctx->async_slaac_cancellation_id); - g_cancellable_disconnect (g_task_get_cancellable (task), ctx->async_slaac_cancellation_id); - ctx->async_slaac_cancellation_id = 0; + if (ctx->async_slaac_cancellation_id) { + g_cancellable_disconnect (g_task_get_cancellable (task), ctx->async_slaac_cancellation_id); + ctx->async_slaac_cancellation_id = 0; + } g_assert (ctx->async_slaac_notification_id); if (g_signal_handler_is_connected (ctx->mbim, ctx->async_slaac_notification_id)) @@ -670,6 +671,12 @@ static void ip_configuration_async_cancelled (GCancellable *cancellable, GTask *task) { + ConnectContext *ctx; + + /* Avoid the explicit g_cancellable_disconnect(), which would deadlock */ + ctx = g_task_get_task_data (task); + ctx->async_slaac_cancellation_id = 0; + ip_configuration_async_cleanup (task); g_task_return_new_error (task, MM_CORE_ERROR, MM_CORE_ERROR_CANCELLED, "Cancelled waiting for SLAAC notification");