sd-bus: unref slot->match_callback.install_slot when slot is disconnected

When a slot is disconnected, then slot->match_callback.install_slot
is also disconnected. So, bus_slot_disconnect() removes the install_slot
from the list of slots in bus, although it is a floating object.
This makes install_slot unreffed from bus when it is disconnected.

Fixes #9505 and #9510.

diff --git a/src/libsystemd/sd-bus/bus-slot.c b/src/libsystemd/sd-bus/bus-slot.c
index 984322a320a51cd4d86d4449cd018905faeed722..17ea8f2ed1d17d1d6ca6935a2f6da7915f25b032 100644 (file)
--- a/src/libsystemd/sd-bus/bus-slot.c
+++ b/src/libsystemd/sd-bus/bus-slot.c
@@ -79,7 +79,10 @@ void bus_slot_disconnect(sd_bus_slot *slot) {
                         (void) bus_remove_match_internal(slot->bus, slot->match_callback.match_string);
 
                 if (slot->match_callback.install_slot) {
-                        bus_slot_disconnect(slot->match_callback.install_slot);
+                        if (slot->match_callback.install_slot->bus) {
+                                bus_slot_disconnect(slot->match_callback.install_slot);
+                                sd_bus_slot_unref(slot->match_callback.install_slot);
+                        }
                         slot->match_callback.install_slot = sd_bus_slot_unref(slot->match_callback.install_slot);
                 }