SymbX/ModemManager
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge request !1465 from 'aleksander/vreports2'

Browse Source 
Various use-after-free fixes

https://gitlab.freedesktop.org/mobile-broadband/ModemManager/-/merge_requests/1465
This commit is contained in:
Aleksander Morgado
2026-07-10 15:02:49 +02:00
parent 691bb4286d 9642ed9ab5
commit 76ca77a897
14 changed files with 99 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/mm-iface-modem-3gpp.c
+3 -2
View File
@@ -3713,10 +3713,11 @@ load_enabled_facility_locks_ready (MMIfaceModem3gpp *self,
g_object_get (self, MM_IFACE_MODEM_SIM, &sim, NULL);
if (sim)
g_signal_connect (sim,
g_signal_connect_object (sim,
MM_BASE_SIM_PIN_LOCK_ENABLED,
G_CALLBACK (sim_pin_lock_enabled_cb),
ctx->skeleton);
ctx->skeleton,
0);
}
/* Go on to next step */
src/mm-iface-modem-cell-broadcast.c
+6 -4
View File
@@ -636,14 +636,16 @@ interface_enabling_step (GTask *task)
NULL);
/* Connect to list's signals */
g_signal_connect (list,
g_signal_connect_object (list,
MM_CBM_ADDED,
G_CALLBACK (cbm_added),
ctx->skeleton);
g_signal_connect (list,
ctx->skeleton,
0);
g_signal_connect_object (list,
MM_CBM_DELETED,
G_CALLBACK (cbm_deleted),
ctx->skeleton);
ctx->skeleton,
0);
ctx->step++;
} /* fall through */
src/mm-iface-modem-messaging.c
+6 -4
View File
@@ -1026,14 +1026,16 @@ interface_enabling_step (GTask *task)
NULL);
/* Connect to list's signals */
g_signal_connect (list,
g_signal_connect_object (list,
MM_SMS_ADDED,
G_CALLBACK (sms_added),
ctx->skeleton);
g_signal_connect (list,
ctx->skeleton,
0);
g_signal_connect_object (list,
MM_SMS_DELETED,
G_CALLBACK (sms_deleted),
ctx->skeleton);
ctx->skeleton,
0);
g_object_unref (list);
src/mm-iface-modem-time.c
+28 -10
View File
@@ -153,6 +153,7 @@ typedef struct {
MMModemState state;
guint network_timezone_poll_id;
guint network_timezone_poll_retries;
guint session_id;
} NetworkTimezoneContext;
static void
@@ -191,23 +192,34 @@ update_network_timezone_dictionary (MMIfaceModemTime *self,
static void
load_network_timezone_ready (MMIfaceModemTime *self,
GAsyncResult *res)
GAsyncResult *res,
gpointer user_data)
{
g_autoptr(GError) error = NULL;
MMNetworkTimezone *tz;
/* Finish the async operation */
tz = MM_IFACE_MODEM_TIME_GET_IFACE (self)->load_network_timezone_finish (self, res, &error);
if (!tz) {
g_autoptr(MMNetworkTimezone) tz = NULL;
NetworkTimezoneContext *ctx;
guint session_id;
mm_obj_dbg (self, "couldn't load network timezone: %s", error->message);
session_id = GPOINTER_TO_UINT (user_data);
/* Finish the async operation first to avoid resource leaks */
tz = MM_IFACE_MODEM_TIME_GET_IFACE (self)->load_network_timezone_finish (self, res, &error);
/* Note: may be NULL if the polling has been removed while processing the async operation */
ctx = (NetworkTimezoneContext *) g_object_get_qdata (G_OBJECT (self), network_timezone_context_quark);
if (!ctx)
return;
/* Check if this is the result of the current poll session */
if (ctx->session_id != session_id) {
mm_obj_dbg (self, "discarding network timezone load result from old session (session ID %u, current %u)",
session_id, ctx->session_id);
return;
}
if (!tz) {
mm_obj_dbg (self, "couldn't load network timezone: %s", error->message);
/* Retry? */
ctx->network_timezone_poll_retries--;
@@ -227,7 +239,6 @@ load_network_timezone_ready (MMIfaceModemTime *self,
/* Got final result properly, update the property in the skeleton */
update_network_timezone_dictionary (self, tz);
g_object_unref (tz);
}
static gboolean
@@ -241,7 +252,7 @@ network_timezone_poll_cb (MMIfaceModemTime *self)
MM_IFACE_MODEM_TIME_GET_IFACE (self)->load_network_timezone (
self,
(GAsyncReadyCallback)load_network_timezone_ready,
NULL);
GUINT_TO_POINTER (ctx->session_id));
return G_SOURCE_REMOVE;
}
@@ -253,7 +264,13 @@ start_network_timezone_poll (MMIfaceModemTime *self)
ctx = (NetworkTimezoneContext *) g_object_get_qdata (G_OBJECT (self), network_timezone_context_quark);
mm_obj_dbg (self, "network timezone polling started");
if (ctx->network_timezone_poll_id) {
g_source_remove (ctx->network_timezone_poll_id);
ctx->network_timezone_poll_id = 0;
}
ctx->session_id++;
mm_obj_dbg (self, "network timezone polling started (session ID %u)", ctx->session_id);
ctx->network_timezone_poll_retries = NETWORK_TIMEZONE_POLL_RETRIES;
ctx->network_timezone_poll_id = g_timeout_add_seconds (NETWORK_TIMEZONE_POLL_INTERVAL_SEC, (GSourceFunc)network_timezone_poll_cb, self);
}
@@ -270,6 +287,7 @@ stop_network_timezone_poll (MMIfaceModemTime *self)
g_source_remove (ctx->network_timezone_poll_id);
ctx->network_timezone_poll_id = 0;
}
ctx->session_id++;
}
static void
src/mm-iface-modem-voice.c
+6 -4
View File
@@ -3019,14 +3019,16 @@ interface_initialization_step (GTask *task)
NULL);
/* Connect to list's signals */
g_signal_connect (list,
g_signal_connect_object (list,
MM_CALL_ADDED,
G_CALLBACK (call_added),
ctx->skeleton);
g_signal_connect (list,
ctx->skeleton,
0);
g_signal_connect_object (list,
MM_CALL_DELETED,
G_CALLBACK (call_deleted),
ctx->skeleton);
ctx->skeleton,
0);
/* Setup monitoring for in-call event handling */
g_signal_connect (list,
src/mm-port-serial-at.c
+1 -1
View File
@@ -241,7 +241,7 @@ parse_unsolicited (MMPortSerial *port, GByteArray *response)
response->len,
0, 0, &match_info, NULL);
if (handler->callback) {
while (g_match_info_matches (match_info)) {
while (g_match_info_matches (match_info) && handler->callback) {
handler->callback (self, match_info, handler->user_data);
g_match_info_next (match_info, NULL);
}
src/mm-shared-qmi.c
+6
View File
@@ -3111,6 +3111,12 @@ list_configs_indication (QmiClientPdc *client,
self = g_task_get_source_object (task);
ctx = g_task_get_task_data (task);
/* Disconnect list-configs indication right away to avoid re-entry */
if (ctx->list_configs_indication_id) {
g_signal_handler_disconnect (ctx->client, ctx->list_configs_indication_id);
ctx->list_configs_indication_id = 0;
}
if (!qmi_indication_pdc_list_configs_output_get_indication_result (output, &error_code, &error)) {
load_carrier_config_abort (task, error);
return;
src/plugins/cinterion/mm-broadband-modem-cinterion.c
+4 -4
View File
@@ -1177,7 +1177,7 @@ modem_3gpp_register_in_network (MMIfaceModem3gpp *_self,
operator_code,
&command,
&error)) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
@@ -1723,14 +1723,14 @@ ws46_query_ready (MMBaseModem *self,
response = mm_base_modem_at_command_finish (self, res, &error);
if (!response) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
if (!mm_cinterion_parse_ws46_response (response,
&(result->allowed),
&error)) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
@@ -1882,7 +1882,7 @@ cops_set_current_modes (MMBroadbandModemCinterion *self,
operator_id,
&command,
&error)) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
src/plugins/cinterion/mm-shared-cinterion.c
+2 -2
View File
@@ -266,7 +266,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self,
priv = get_private (MM_SHARED_CINTERION (self));
update_settings = priv->iface_modem_firmware_parent->load_update_settings_finish (self, res, &error);
if (error) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
@@ -276,7 +276,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self,
ids = mm_iface_firmware_build_generic_device_ids (MM_IFACE_MODEM_FIRMWARE (self), &error);
if (error) {
mm_obj_warn (self, "failed to build generic device ids: %s", error->message);
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
src/plugins/fibocom/mm-shared-fibocom.c
+1 -1
View File
@@ -343,7 +343,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self,
priv = get_private (MM_SHARED_FIBOCOM (self));
update_settings = priv->iface_modem_firmware_parent->load_update_settings_finish (self, res, &error);
if (error) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
src/plugins/foxconn/mm-broadband-modem-mbim-foxconn.c
+1 -1
View File
@@ -276,7 +276,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self,
update_settings = iface_modem_firmware_parent->load_update_settings_finish (self, res, &error);
if (error) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
src/plugins/quectel/mm-broadband-modem-quectel.c
+1 -1
View File
@@ -212,7 +212,7 @@ power_off_ready (MMBroadbandModemQuectel *self,
*/
if (!mm_base_modem_at_command_finish (MM_BASE_MODEM (self), res, &error)) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
src/plugins/quectel/mm-shared-quectel.c
+13 -3
View File
@@ -152,6 +152,14 @@ mm_shared_quectel_create_wwan_port (MMBaseModem *self,
/*****************************************************************************/
/* RDY unsolicited event handler */
static gboolean
rdy_handler_idle (MMBroadbandModem *self)
{
mm_base_modem_set_reprobe (MM_BASE_MODEM (self), TRUE);
mm_base_modem_set_valid (MM_BASE_MODEM (self), FALSE);
return G_SOURCE_REMOVE;
}
static void
rdy_handler (MMPortSerialAt *port,
GMatchInfo *match_info,
@@ -162,8 +170,10 @@ rdy_handler (MMPortSerialAt *port,
* re-synchronize modem and ModemManager states by re-probing.
*/
mm_obj_warn (self, "modem reset detected, triggering reprobe");
mm_base_modem_set_reprobe (MM_BASE_MODEM (self), TRUE);
mm_base_modem_set_valid (MM_BASE_MODEM (self), FALSE);
g_idle_add_full (G_PRIORITY_DEFAULT_IDLE,
(GSourceFunc) rdy_handler_idle,
g_object_ref (self),
g_object_unref);
}
/*****************************************************************************/
@@ -475,7 +485,7 @@ parent_load_update_settings_ready (MMIfaceModemFirmware *self,
priv = get_private (MM_SHARED_QUECTEL (self));
update_settings = priv->iface_modem_firmware_parent->load_update_settings_finish (self, res, &error);
if (error) {
g_task_return_error (task, error);
g_task_return_error (task, g_steal_pointer (&error));
g_object_unref (task);
return;
}
src/plugins/ublox/mm-plugin-ublox.c
+3
View File
@@ -113,6 +113,9 @@ ready_received (MMPortSerialAt *port,
g_source_remove (ctx->timeout_id);
ctx->timeout_id = 0;
mm_port_serial_at_add_unsolicited_msg_handler (port, ctx->ready_regex,
NULL, NULL, NULL);
mm_obj_dbg (probe, "received READY: port is AT");
/* Flag as an AT port right away */