sd-dhcp6: fix crash by unrefing event sources before re-adding them

In certain cases the timeouts may not have been unref'ed before they
need to be re-added. Add the appropriate unref calls to ensure we don't
register the timeout multiple times.

This fixes possible cases where timeouts are triggered multiple times
and even on destroyed DHCPv6 clients.

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/73

Fixes #10749.

diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c
index 15aece87d808ab438ce23539921bce2411297692..ac21afbb173b28c83400ab397910253febdc7f72 100644 (file)
--- a/src/libsystemd-network/sd-dhcp6-client.c
+++ b/src/libsystemd-network/sd-dhcp6-client.c
@@ -1332,6 +1332,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) {
                 log_dhcp6_client(client, "T1 expires in %s",
                                  format_timespan(time_string, FORMAT_TIMESPAN_MAX, timeout, USEC_PER_SEC));
 
+                client->timeout_t1 = sd_event_source_unref(client->timeout_t1);
                 r = sd_event_add_time(client->event,
                                       &client->timeout_t1,
                                       clock_boottime_or_monotonic(), time_now + timeout,
@@ -1354,6 +1355,7 @@ static int client_start(sd_dhcp6_client *client, enum DHCP6State state) {
                 log_dhcp6_client(client, "T2 expires in %s",
                                  format_timespan(time_string, FORMAT_TIMESPAN_MAX, timeout, USEC_PER_SEC));
 
+                client->timeout_t2 = sd_event_source_unref(client->timeout_t2);
                 r = sd_event_add_time(client->event,
                                       &client->timeout_t2,
                                       clock_boottime_or_monotonic(), time_now + timeout,