Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-22 21:22:37 +01:00
Code Releases Activity

network: Sort out reference counting

Browse Source 
Agent implementation inside agent.c takes a reference of the trigger
message associated with the request.  When the callback is called, the
message is passed as an argument.  The callback is responsible for
taking the message reference if necessary.  Once the callback returns,
agent releases its reference.

For error paths, our code was using dbus_pending_reply which in turn
uses dbus_message_unref.  This caused the agent to try an unref
operation on an already freed object.
This commit is contained in:
Denis Kenzior 2017-05-11 19:48:07 -05:00
parent 50d04e99a7
commit b36dd5203e
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/network.c
View File

@ -514,6 +514,13 @@ static void passphrase_callback(enum agent_result result,
network->agent_request = 0; network->agent_request = 0;
/*
* agent will release its reference to message after invoking this
* callback. So if we want this message, we need to take a reference
* to it
*/
l_dbus_message_ref(message);
if (result != AGENT_RESULT_OK) { if (result != AGENT_RESULT_OK) {
dbus_pending_reply(&message, dbus_error_aborted(message)); dbus_pending_reply(&message, dbus_error_aborted(message));
goto err; goto err;
@ -549,6 +556,7 @@ static void passphrase_callback(enum agent_result result,
network->update_psk = true; network->update_psk = true;
device_connect_network(network->device, network, bss, message); device_connect_network(network->device, network, bss, message);
l_dbus_message_unref(message);
return; return;
err: err: