Bug 2039331

Summary:	libnm: dangling pointer while destroying NMClient (or removing object from D-Bus) can lead to crash
Product:	Red Hat Enterprise Linux 8	Reporter:	Thomas Haller <thaller>
Component:	NetworkManager	Assignee:	Thomas Haller <thaller>
Status:	CLOSED ERRATA	QA Contact:	Filip Pokryvka <fpokryvk>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.4	CC:	bgalvani, ferferna, fpokryvk, lrintel, rkhan, sukulkar, till
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	NetworkManager-1.36.0-0.7.el8	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-10 14:55:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Thomas Haller 2022-01-11 13:59:04 UTC

Upstream reported here: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/896

libnm can expose dangling pointers, which can cause crashes (in users that access them).

Comment 1 Beniamino Galvani 2022-01-24 10:21:58 UTC

I could reproduce using the NM binary at https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/896 :

    ./gnome-control-center

   ** (gnome-control-center:3687221): WARNING **: 11:16:54.612: Ignoring broken panel privacy (missing desktop file)
   **
   nm:ERROR:../src/libnm-client-impl/nm-device.c:1730:nm_device_get_active_connection: assertion failed: (!ac || (((__extension__ ({ GTypeInstance *__inst = (GTypeInstance*) ((ac)); GType __t = ((nm_active_connection_get_type())); gboole\
an __r; if (!__inst) __r = (0); else if (__inst->g_class && __inst->g_class->g_type == __t) __r = (!(0)); else __r = g_type_check_instance_is_a (__inst, __t); __r; })))))
   Bail out! nm:ERROR:../src/libnm-client-impl/nm-device.c:1730:nm_device_get_active_connection: assertion failed: (!ac || (((__extension__ ({ GTypeInstance *__inst = (GTypeInstance*) ((ac)); GType __t = ((nm_active_connection_get_type()\
)); gboolean __r; if (!__inst) __r = (0); else if (__inst->g_class && __inst->g_class->g_type == __t) __r = (!(0)); else __r = g_type_check_instance_is_a (__inst, __t); __r; })))))
   Aborted (core dumped)


The crash doesn't happen with the patch.

Comment 2 Thomas Haller 2022-01-25 20:47:39 UTC

back to assigned: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/896#note_1231345

Comment 5 Filip Pokryvka 2022-02-17 11:05:43 UTC

Covered in unit tests.

Comment 8 errata-xmlrpc 2022-05-10 14:55:01 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (NetworkManager bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:1985