Bug 1758128

it's crashing even on 1.10.6 http://faf.lab.eng.brq.redhat.com/faf/reports/14001/

test case looks like this:
    Scenario: nmcli - gsm_sim - mtu
    Given "gsm" is visible with command "nmcli device status | grep -v unmanaged" in "60" seconds
    * Add a new connection of type "gsm" and options "ifname \* con-name gsm autoconnect no apn internet"
    * Bring "up" connection "gsm"
    When "default" is visible with command "ip r |grep 700" in "60" seconds
     And "mtu 1500" is visible with command "nmcli |grep gsm"
    * Execute "nmcli con modify gsm gsm.mtu 1600"
    * Bring "down" connection "gsm"
    * Wait for at least "2" seconds
    * Execute "sh prepare/gsm_sim.sh teardown"
    * Wait for at least "2" seconds
    * Run child "sh prepare/gsm_sim.sh modemu"
    When "gsm" is visible with command "nmcli device status | grep -v unmanaged" in "60" seconds
    * Bring "up" connection "gsm"
    When "GENERAL.STATE:.*activated" is visible with command "nmcli con show gsm" in "60" seconds
    Then "mtu 1600" is visible with command "ip a s |grep mtu" in "10" seconds
     And "mtu 1600" is visible with command "nmcli |grep gsm"


we need to have teardown/setup on the virtual gsm device running as otherwise up is not working anymore. But for this case, the 2 seconds delay between connection down and device removal seems to be important and is now a workaround.

So one would say that if a modem's connection is going down and the modem is removed MM can crash here.

Core was generated by `/usr/sbin/ModemManager'.
Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50        return ret;
[Current thread is 1 (Thread 0x7feddebe4540 (LWP 32399))]
 
Thread 1 (Thread 0x7feddebe4540 (LWP 32399)):
#0  0x00007feddcab18df in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {0, 94774358790511, 94774386992576, 140659592752460, 0, 140659592312861, 140726398430632, 140659586920036, 0, 91, 91, 94774386874096, 2048, 0, 7, 0}}
        pid = <optimized out>
        tid = <optimized out>
#1  0x00007feddca9bcf5 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x7feddd0fe3f0, sa_sigaction = 0x7feddd0fe3f0}, sa_mask = {__val = {140724603453441, 0, 87, 94774387093024, 5686234409824314880, 94774386192992, 140659592990430, 140659592803274, 94774610624512, 94774387093024, 5686234409824314880, 0, 94774387093024, 88, 140659595365920, 140726398431040}}, sa_flags = 1610441736, sa_restorer = 0x563261aa9ca0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007feddd079003 in g_assertion_message (domain=<optimized out>, file=<optimized out>, line=<optimized out>, func=0x56325ffd6408 "finalize", message=<optimized out>) at gtestutils.c:2532
        lstr = "2067\000\177\000\000\000f.\233\021\220\351N\000\000\000\000\000\000\000\000\060W\375_2V\000"
        s = 0x563261ad2e20 "\200\006\255a2V"
#3  0x00007feddd0d1fde in g_assertion_message_expr (domain=0x0, file=0x56325ffd516f "mm-port-serial.c", line=2067, func=0x56325ffd6408 "finalize", expr=<optimized out>) at gtestutils.c:2555
        s = 0x7fedc8003e50 "assertion failed: (self->priv->iochannel == NULL)"
#4  0x000056325ff8ccaa in finalize ()
#5  0x00007feddd38b8a9 in g_object_unref (_object=<optimized out>) at gobject.c:3340
        weak_locations = <optimized out>
        old_ref = <optimized out>
        __func__ = "g_object_unref"
        object = 0x563261a465f0 [MMPortSerialAt]
        __func__ = "g_object_unref"
#6  0x00007feddd38b8a9 in g_object_unref (_object=0x563261a465f0) at gobject.c:3232
        object = 0x563261a465f0 [MMPortSerialAt]
        __func__ = "g_object_unref"
#7  0x00007feddd65c4be in g_task_finalize (object=0x563261a42b50 [GTask]) at gtask.c:634
        _pp = {in = 0x563261a42b68 "", out = 0x563261a42b68}
        _p = <optimized out>
        task = 0x563261a42b50 [GTask]
#8  0x00007feddd38b8a9 in g_object_unref (_object=<optimized out>) at gobject.c:3340
        weak_locations = <optimized out>
        old_ref = <optimized out>
        __func__ = "g_object_unref"
        object = 0x563261a42b50 [GTask]
        __func__ = "g_object_unref"
#9  0x00007feddd38b8a9 in g_object_unref (_object=0x563261a42b50) at gobject.c:3232
        object = 0x563261a42b50 [GTask]
        __func__ = "g_object_unref"
#10 0x000056325ff8bfec in _close_internal ()
#11 0x000056325ff8c4e6 in port_serial_close_force ()
#12 0x000056325ff8c863 in common_input_available ()
#13 0x00007feddd0aa67d in g_main_dispatch (context=0x5632619f7700) at gmain.c:3176
        dispatch = 0x7feddd0f1d30 <g_io_unix_dispatch>
        prev_source = 0x0
        was_in_call = 0
        user_data = 0x563261a465f0
        callback = 0x56325ff8c9b0 <iochannel_input_available>
        cb_funcs = 0x7feddd374280 <g_source_callback_funcs>
        cb_data = 0x563261acb5c0
        need_destroy = <optimized out>
        source = 0x563261aa9ca0
        current = 0x5632619f2ec0
        i = 1
        __func__ = "g_main_dispatch"
#14 0x00007feddd0aa67d in g_main_context_dispatch (context=context@entry=0x5632619f7700) at gmain.c:3829
#15 0x00007feddd0aaa48 in g_main_context_iterate (context=0x5632619f7700, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3902
        max_priority = 2147483647
        timeout = 5
        some_ready = 1
        nfds = <optimized out>
        allocated_nfds = 3
        fds = 0x563261a100a0
#16 0x00007feddd0aad72 in g_main_loop_run (loop=0x5632619daa20) at gmain.c:4098
        __func__ = "g_main_loop_run"
#17 0x000056325fef8225 in main ()
 
Thread 2 (Thread 0x7fedd8cff700 (LWP 32400)):
#0  0x00007feddcb6b211 in __GI___poll (fds=0x5632619d3230, nfds=1, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
        resultvar = 18446744073709551100
        sc_cancel_oldtype = 0
#1  0x00007feddd0aa9b6 in g_main_context_poll (priority=<optimized out>, n_fds=1, fds=0x5632619d3230, timeout=<optimized out>, context=0x5632619f6390) at gmain.c:4203
        ret = <optimized out>
        errsv = <optimized out>
        poll_func = 0x7feddd0ba360 <g_poll>
        max_priority = 2147483647
        timeout = -1
        some_ready = <optimized out>
        nfds = 1
        allocated_nfds = 1
        fds = 0x5632619d3230
#2  0x00007feddd0aa9b6 in g_main_context_iterate (context=context@entry=0x5632619f6390, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3897
        max_priority = 2147483647
        timeout = -1
        some_ready = <optimized out>
        nfds = 1
        allocated_nfds = 1
        fds = 0x5632619d3230
#3  0x00007feddd0aaae0 in g_main_context_iteration (context=0x5632619f6390, may_block=may_block@entry=1) at gmain.c:3963
        retval = <optimized out>
#4  0x00007feddd0aab31 in glib_worker_main (data=<optimized out>) at gmain.c:5772
#5  0x00007feddd0d2d9a in g_thread_proxy (data=0x5632619f6800) at gthread.c:784
        thread = 0x5632619f6800
        __func__ = "g_thread_proxy"
#6  0x00007feddce452de in start_thread (arg=<optimized out>) at pthread_create.c:486
        ret = <optimized out>
        pd = <optimized out>
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140659521484544, 3844436083940110238, 140726398433070, 140726398433071, 140726398433200, 140659521481664, -3854624295452823650, -3854632717663883362}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
#7  0x00007feddcb76133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
 
Thread 3 (Thread 0x7fedd2ffd700 (LWP 32403)):
#0  0x00007feddcb6b211 in __GI___poll (fds=0x7fedcc0108d0, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
        resultvar = 1
        sc_cancel_oldtype = 0
#1  0x00007feddd0aa9b6 in g_main_context_poll (priority=<optimized out>, n_fds=2, fds=0x7fedcc0108d0, timeout=<optimized out>, context=0x7fedcc00e630) at gmain.c:4203
        ret = <optimized out>
        errsv = <optimized out>
        poll_func = 0x7feddd0ba360 <g_poll>
        max_priority = 2147483647
        timeout = -1
        some_ready = <optimized out>
        nfds = 2
        allocated_nfds = 2
        fds = 0x7fedcc0108d0
#2  0x00007feddd0aa9b6 in g_main_context_iterate (context=0x7fedcc00e630, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3897
        max_priority = 2147483647
        timeout = -1
        some_ready = <optimized out>
        nfds = 2
        allocated_nfds = 2
        fds = 0x7fedcc0108d0
#3  0x00007feddd0aad72 in g_main_loop_run (loop=0x7fedcc00e770) at gmain.c:4098
        __func__ = "g_main_loop_run"
#4  0x00007feddd6a03ba in gdbus_shared_thread_func (user_data=0x7fedcc00e600) at gdbusprivate.c:275
        data = 0x7fedcc00e600
#5  0x00007feddd0d2d9a in g_thread_proxy (data=0x5632619f72d0) at gthread.c:784
        thread = 0x5632619f72d0
        __func__ = "g_thread_proxy"
#6  0x00007feddce452de in start_thread (arg=<optimized out>) at pthread_create.c:486
        ret = <optimized out>
        pd = <optimized out>
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140659423958784, 3844436083940110238, 140659440740494, 140659440740495, 140659440740624, 140659423955904, -3854646147172683874, -3854632717663883362}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>

This seems to be fixed by the update to 1.10.8 MM release (that is planned for 8.2)

Fixed by commit: 21e5b1d68336ec5a19f71e36c035e19d29623ca2 backported to RHEL 8.2.

Cannot see any more crashes with the latest version.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:1781