From: Benjamin Berg <bberg@redhat.com>
Date: Thu, 15 Nov 2018 22:09:43 +0000 (+0900)
Subject: sd-dhcp6: fix crash by unrefing event sources before re-adding them
X-Git-Tag: v240~300^2~10
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a5f07d2a16912a4c7151ab262aa43941f519926d;p=thirdparty%2Fsystemd.git

sd-dhcp6: fix crash by unrefing event sources before re-adding them

In certain cases the timeouts may not have been unref'ed before they
need to be re-added. Add the appropriate unref calls to ensure we don't
register the timeout multiple times.

This fixes possible cases where timeouts are triggered multiple times
and even on destroyed DHCPv6 clients.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/73

Fixes #10749.
---

diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c
index 15aece87d80..ac21afbb173 100644
--- a/src/libsystemd-network/sd-dhcp6-client.c
+++ b/src/libsystemd-network/sd-dhcp6-client.c
@@ -1332,6 +1332,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) {
                 log_dhcp6_client(client, "T1 expires in %s",
                                  format_timespan(time_string, FORMAT_TIMESPAN_MAX, timeout, USEC_PER_SEC));
 
+                client->timeout_t1 = sd_event_source_unref(client->timeout_t1);
                 r = sd_event_add_time(client->event,
                                       &client->timeout_t1,
                                       clock_boottime_or_monotonic(), time_now + timeout,
@@ -1354,6 +1355,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) {
                 log_dhcp6_client(client, "T2 expires in %s",
                                  format_timespan(time_string, FORMAT_TIMESPAN_MAX, timeout, USEC_PER_SEC));
 
+                client->timeout_t2 = sd_event_source_unref(client->timeout_t2);
                 r = sd_event_add_time(client->event,
                                       &client->timeout_t2,
                                       clock_boottime_or_monotonic(), time_now + timeout,