Blob Blame History Raw
commit 21defe6d73853bf19c6ce99d07701d1531e09409
Author: Drew Moseley <dmoseley@mvista.com>
Date:   Fri Mar 6 17:19:17 2009 -0500

    core: fix use-after-free caused by incorrect HAL device resync code

diff --git a/src/nm-manager.c b/src/nm-manager.c
index a6bac55..d0e5564 100644
--- a/src/nm-manager.c
+++ b/src/nm-manager.c
@@ -1426,12 +1426,11 @@ static void
 sync_devices (NMManager *self)
 {
 	NMManagerPrivate *priv = NM_MANAGER_GET_PRIVATE (self);
-	GSList *devices;
+	GSList *devices = NULL;
 	GSList *iter;
 
-	/* Remove devices which are no longer known to HAL */
-	devices = g_slist_copy (priv->devices);
-	for (iter = devices; iter; iter = iter->next) {
+	/* Keep devices still known to HAL; get rid of ones HAL no longer knows about */
+	for (iter = priv->devices; iter; iter = iter->next) {
 		NMDevice *device = NM_DEVICE (iter->data);
 		const char *udi = nm_device_get_udi (device);
 
@@ -1440,15 +1439,14 @@ sync_devices (NMManager *self)
 				nm_device_set_managed (device, TRUE, NM_DEVICE_STATE_REASON_NOW_MANAGED);
 			else
 				nm_device_set_managed (device, FALSE, NM_DEVICE_STATE_REASON_NOW_UNMANAGED);
-		} else {
-			priv->devices = g_slist_delete_link (priv->devices, iter);
+			devices = g_slist_prepend (devices, device);
+		} else
 			remove_one_device (self, device);
-		}
 	}
+	g_slist_free (priv->devices);
+	priv->devices = devices;
 
-	g_slist_free (devices);
-
-	/* Get any new ones */
+	/* Ask HAL for new devices */
 	nm_hal_manager_query_devices (priv->hal_mgr);
 }