rpms
/
NetworkManager
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

policy: fix looping through list while removing elements (rh #1175446)

This commit is contained in:
Jiří Klimeš 2015-11-05 15:50:41 +01:00
parent 2a565aaea6
commit 932c700385
2 changed files with 60 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
NetworkManager.spec
View File

@ -103,6 +103,7 @@ Patch13: nmtui-fix-crash-in-secret-agent.patch
Patch14: libnm-fix-introspection-annotation.patch
Patch15: rh1272974-fix-s390-ctc-detection.patch
Patch16: rh1277693-vpn-service-timer.patch
Patch17: rh1175446-vpn-secondaries-connections.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@ -396,6 +397,7 @@ by nm-connection-editor and nm-applet in a non-graphical environment.
%patch14 -p1
%patch15 -p1
%patch16 -p1
%patch17 -p1
%build
@ -716,6 +718,7 @@ fi
%changelog
* Thu Nov 5 2015 Jiří Klimeš <jklimes@redhat.com> - 1:1.0.6-8
- vpn: increase vpn service timeout to 180 seconds (rh #1277693)
- policy: fix looping through list while removing elements (rh #1175446)
* Mon Oct 19 2015 Jiří Klimeš <jklimes@redhat.com> - 1:1.0.6-7
- libnm-core: fix a crash in priority_strv_to_maplist()

57
rh1175446-vpn-secondaries-connections.patch Normal file
View File

@ -0,0 +1,57 @@
From 112f3f8aca99d96bf94d724769e563cc44e5a4c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ji=C5=99=C3=AD=20Klime=C5=A1?= <jklimes@redhat.com>
Date: Wed, 4 Nov 2015 15:48:28 +0100
Subject: [PATCH] policy: fix looping through list while removing elements (rh
#1175446)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
When g_slist_remove() was called, iter2 became invalid and accessing it
could cause a crash. The same was true for iter.
Fix the problem by getting the next list item before an element removal.
See a similar fix in bluez
http://git.kernel.org/cgit/bluetooth/bluez.git/commit/?id=be8c5be809875ba449a10ca29f5244f0231f6b63
https://bugzilla.redhat.com/show_bug.cgi?id=1175446
https://bugzilla.redhat.com/show_bug.cgi?id=1277247
(cherry picked from commit b9da3d93207e46de895fd07cfe9de1edfa79efef)
Signed-off-by: Jiří Klimeš <jklimes@redhat.com>
---
src/nm-policy.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 8a573c8..1be5c4a 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -754,17 +754,21 @@ process_secondaries (NMPolicy *policy,
gboolean connected)
{
NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (policy);
- GSList *iter, *iter2;
+ GSList *iter, *iter2, *next, *next2;
/* Loop through devices waiting for secondary connections to activate */
- for (iter = priv->pending_secondaries; iter; iter = g_slist_next (iter)) {
+ for (iter = priv->pending_secondaries; iter; iter = next) {
PendingSecondaryData *secondary_data = (PendingSecondaryData *) iter->data;
NMDevice *item_device = secondary_data->device;
+ next = g_slist_next (iter);
+
/* Look for 'active' in each device's secondary connections list */
- for (iter2 = secondary_data->secondaries; iter2; iter2 = g_slist_next (iter2)) {
+ for (iter2 = secondary_data->secondaries; iter2; iter2 = next2) {
NMActiveConnection *secondary_active = NM_ACTIVE_CONNECTION (iter2->data);
+ next2 = g_slist_next (iter2);
+
if (active != secondary_active)
continue;
--
2.1.0