From a5f07d2a16912a4c7151ab262aa43941f519926d Mon Sep 17 00:00:00 2001 From: Benjamin Berg Date: Fri, 16 Nov 2018 07:09:43 +0900 Subject: [PATCH] sd-dhcp6: fix crash by unrefing event sources before re-adding them In certain cases the timeouts may not have been unref'ed before they need to be re-added. Add the appropriate unref calls to ensure we don't register the timeout multiple times. This fixes possible cases where timeouts are triggered multiple times and even on destroyed DHCPv6 clients. https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/73 Fixes #10749. --- src/libsystemd-network/sd-dhcp6-client.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c index 15aece87d8..ac21afbb17 100644 --- a/src/libsystemd-network/sd-dhcp6-client.c +++ b/src/libsystemd-network/sd-dhcp6-client.c @@ -1332,6 +1332,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) { log_dhcp6_client(client, "T1 expires in %s", format_timespan(time_string, FORMAT_TIMESPAN_MAX, timeout, USEC_PER_SEC)); + client->timeout_t1 = sd_event_source_unref(client->timeout_t1); r = sd_event_add_time(client->event, &client->timeout_t1, clock_boottime_or_monotonic(), time_now + timeout, @@ -1354,6 +1355,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) { log_dhcp6_client(client, "T2 expires in %s", format_timespan(time_string, FORMAT_TIMESPAN_MAX, timeout, USEC_PER_SEC)); + client->timeout_t2 = sd_event_source_unref(client->timeout_t2); r = sd_event_add_time(client->event, &client->timeout_t2, clock_boottime_or_monotonic(), time_now + timeout,