From: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Date: Fri, 5 Jun 2020 12:24:57 +0000 (+0200)
Subject: networkd: take ref immediately after storing item in set
X-Git-Tag: v246-rc1~105^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=39dbd0c74c4a686e37602d38bfb8bb1d4bbc7a71;p=thirdparty%2Fsystemd.git

networkd: take ref immediately after storing item in set

I'm not sure if I understand the code correctly, but it seems that if
storig in the second set failed, we'd return with the first set having
no reference on the link object, and the link object could be freed in the
future, leaving the set with a dangling reference.
---

diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index baa1cd3f7fd..c2fb21c7360 100644
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -3129,12 +3129,12 @@ static int link_configure_duid(Link *link) {
                 r = set_put(m->links_requesting_uuid, link);
                 if (r < 0)
                         return log_oom();
+                if (r > 0)
+                        link_ref(link);
 
                 r = set_put(m->duids_requesting_uuid, duid);
                 if (r < 0)
                         return log_oom();
-
-                link_ref(link);
         }
 
         return 0;
diff --git a/src/network/networkd-manager.c b/src/network/networkd-manager.c
index 14a883aa305..08666fd92d1 100644
--- a/src/network/networkd-manager.c
+++ b/src/network/networkd-manager.c
@@ -2312,12 +2312,12 @@ int manager_request_product_uuid(Manager *m, Link *link) {
                 r = set_ensure_put(&m->links_requesting_uuid, NULL, link);
                 if (r < 0)
                         return log_oom();
+                if (r > 0)
+                        link_ref(link);
 
                 r = set_ensure_put(&m->duids_requesting_uuid, NULL, duid);
                 if (r < 0)
                         return log_oom();
-
-                link_ref(link);
         }
 
         if (!m->bus || sd_bus_is_ready(m->bus) <= 0) {