mirror of git://git.sysmocom.de/ofono
2d6c4f9d02
When qmi_device_shutdown is used and the callback provided utilizes qmi_device_unref, an access into already freed memory is triggered. Sequence of events is: 1. timeout fires 2. glib calls timeout callback (e.g. shutdown_callback) which in turn calls shutdown_func (gobi shutdown_cb) which in turn calls qmi_device_unref() 3. qmi_device_unref calls g_source_remove, which doesn't call the destroy callback (it is blocked) 4. qmi_device_unref then frees the memory used by device 5. glib then calls the source destroy callback (e.g. shutdown_destroy) which results in just freed memory being used. glib appears to always call the destroy callback, even if the source has been removed previously. So to work around the issue, delay the actual g_free until the destroy callback is invoked. |
||
|---|---|---|
| .. | ||
| atmodem | ||
| calypsomodem | ||
| cdmamodem | ||
| dunmodem | ||
| gemaltomodem | ||
| hfpmodem | ||
| hsomodem | ||
| huaweimodem | ||
| iceramodem | ||
| ifxmodem | ||
| infineonmodem | ||
| isimodem | ||
| mbmmodem | ||
| nwmodem | ||
| qmimodem | ||
| rilmodem | ||
| speedupmodem | ||
| stemodem | ||
| swmodem | ||
| telitmodem | ||
| ubloxmodem | ||
| ztemodem | ||