core: unit: remove bus slot after calling unit_done()

The ->done callback in the unit's vtable might call into
unit_unwatch_bus_name() and corrupt memory by that.

Move the call down, and clean up the bus slot in case it hasn't been done
yet.

diff --git a/src/core/unit.c b/src/core/unit.c
index 6cc5824eb219f379bb590c79f2e33e65ceb46a23..43a5ca10641448da0f69ebfd35b102db700076bb 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -478,11 +478,12 @@ void unit_free(Unit *u) {
         if (u->manager->n_reloading <= 0)
                 unit_remove_transient(u);
 
-        sd_bus_slot_unref(u->match_bus_slot);
         bus_unit_send_removed_signal(u);
 
         unit_done(u);
 
+        sd_bus_slot_unref(u->match_bus_slot);
+
         unit_free_requires_mounts_for(u);
 
         SET_FOREACH(t, u->names, i)