From: Martin Wilck <mwilck@suse.com>
Date: Tue, 12 Nov 2019 15:43:42 +0000 (+0100)
Subject: udevd: fix crash when workers time out after exit is signal caught
X-Git-Tag: v244-rc1~66^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F13961%2Fhead;p=thirdparty%2Fsystemd.git

udevd: fix crash when workers time out after exit is signal caught

If udevd receives an exit signal, it releases its reference on the udev
monitor in manager_exit(). If at this time a worker is hanging, and if
the event timeout for this worker expires before udevd exits, udevd
crashes in on_sigchld()->udev_monitor_send_device(), because the monitor
has already been freed.

Fix this by releasing the main process's monitor ref later, in
manager_free().
---

diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index 144a20ec63f..2bb322796b2 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -293,6 +293,8 @@ static void manager_free(Manager *manager) {
         if (!manager)
                 return;
 
+        manager->monitor = sd_device_monitor_unref(manager->monitor);
+
         udev_builtin_exit();
 
         if (manager->pid == getpid_cached())
@@ -789,8 +791,6 @@ static void manager_exit(Manager *manager) {
         manager->inotify_event = sd_event_source_unref(manager->inotify_event);
         manager->fd_inotify = safe_close(manager->fd_inotify);
 
-        manager->monitor = sd_device_monitor_unref(manager->monitor);
-
         /* discard queued events and kill workers */
         event_queue_cleanup(manager, EVENT_QUEUED);
         manager_kill_workers(manager);