From ce9388d72a710ffc4840572fecdfe7d9c0be0956 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 17 May 2021 15:23:57 +0900
Subject: [PATCH] network: fix possible message counter double decrement

When after_configure() for a request fails, then the request is not
removed from the queue at that time, and the link enters to failed
state. After that, if the link is reconfigured or its carrier is lost,
then the request is dropped from the queue, and the message_counter is
decreased. However, the counter is already or will be also decreased
when the corresponding netlink reply is received.
So, the counter is decreased twice.
---
 src/network/networkd-address.c             | 3 +++
 src/network/networkd-neighbor.c            | 3 +++
 src/network/networkd-nexthop.c             | 3 +++
 src/network/networkd-route.c               | 3 +++
 src/network/networkd-routing-policy-rule.c | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/src/network/networkd-address.c b/src/network/networkd-address.c
index 5a3388c3c4..daf959ec5f 100644
--- a/src/network/networkd-address.c
+++ b/src/network/networkd-address.c
@@ -1149,6 +1149,9 @@ int request_process_address(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
diff --git a/src/network/networkd-neighbor.c b/src/network/networkd-neighbor.c
index 2afe71c5f8..88620579ac 100644
--- a/src/network/networkd-neighbor.c
+++ b/src/network/networkd-neighbor.c
@@ -479,6 +479,9 @@ int request_process_neighbor(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
diff --git a/src/network/networkd-nexthop.c b/src/network/networkd-nexthop.c
index 5c6c58356c..013bddf30c 100644
--- a/src/network/networkd-nexthop.c
+++ b/src/network/networkd-nexthop.c
@@ -751,6 +751,9 @@ int request_process_nexthop(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
diff --git a/src/network/networkd-route.c b/src/network/networkd-route.c
index 8707e5c089..e6c1d71265 100644
--- a/src/network/networkd-route.c
+++ b/src/network/networkd-route.c
@@ -1622,6 +1622,9 @@ int request_process_route(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 assert(n_routes > 0);
 
diff --git a/src/network/networkd-routing-policy-rule.c b/src/network/networkd-routing-policy-rule.c
index 9b9880d1da..20512d2477 100644
--- a/src/network/networkd-routing-policy-rule.c
+++ b/src/network/networkd-routing-policy-rule.c
@@ -814,6 +814,9 @@ int request_process_routing_policy_rule(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)