broadband-modem-mbim: explicitly remove notification handler on unref

When we remove the last object reference, make sure the notification
handler is also removed, or we may end up using an already freed
object.

https://retrace.fedoraproject.org/faf/reports/1815001/

1 files changed, 38 insertions, 23 deletions

diff --git a/src/mm-broadband-modem-mbim.c b/src/mm-broadband-modem-mbim.c
index 815f5455..8a722b11 100644
--- a/src/mm-broadband-modem-mbim.c
+++ b/src/mm-broadband-modem-mbim.c
@@ -2215,24 +2215,12 @@ device_notification_cb (MbimDevice *device,
     }
 }
 
-static gboolean
-common_setup_cleanup_unsolicited_events_finish (MMBroadbandModemMbim *self,
-                                                GAsyncResult *res,
-                                                GError **error)
-{
-    return g_task_propagate_boolean (G_TASK (res), error);
-}
-
 static void
-common_setup_cleanup_unsolicited_events (MMBroadbandModemMbim *self,
-                                         gboolean setup,
-                                         GAsyncReadyCallback callback,
-                                         gpointer user_data)
+common_setup_cleanup_unsolicited_events_sync (MMBroadbandModemMbim *self,
+                                              MbimDevice           *device,
+                                              gboolean              setup)
 {
-    MbimDevice *device;
-    GTask *task;
-
-    if (!peek_device (self, &device, callback, user_data))
+    if (!device)
         return;
 
     mm_dbg ("Supported notifications: signal (%s), registration (%s), sms (%s), connect (%s), subscriber (%s), packet (%s)",
@@ -2260,6 +2248,29 @@ common_setup_cleanup_unsolicited_events (MMBroadbandModemMbim *self,
             self->priv->notification_id = 0;
         }
     }
+}
+
+static gboolean
+common_setup_cleanup_unsolicited_events_finish (MMBroadbandModemMbim  *self,
+                                                GAsyncResult          *res,
+                                                GError               **error)
+{
+    return g_task_propagate_boolean (G_TASK (res), error);
+}
+
+static void
+common_setup_cleanup_unsolicited_events (MMBroadbandModemMbim *self,
+                                         gboolean              setup,
+                                         GAsyncReadyCallback   callback,
+                                         gpointer              user_data)
+{
+    GTask      *task;
+    MbimDevice *device;
+
+    if (!peek_device (self, &device, callback, user_data))
+        return;
+
+    common_setup_cleanup_unsolicited_events_sync (self, device, setup);
 
     task = g_task_new (self, NULL, callback, user_data);
     g_task_return_boolean (task, TRUE);
@@ -3174,20 +3185,24 @@ mm_broadband_modem_mbim_init (MMBroadbandModemMbim *self)
 static void
 finalize (GObject *object)
 {
-    MMPortMbim *mbim;
     MMBroadbandModemMbim *self = MM_BROADBAND_MODEM_MBIM (object);
+    MMPortMbim *mbim;
+
+    mbim = mm_base_modem_peek_port_mbim (MM_BASE_MODEM (self));
+    if (mbim) {
+        /* Explicitly remove notification handler */
+        self->priv->setup_flags = PROCESS_NOTIFICATION_FLAG_NONE;
+        common_setup_cleanup_unsolicited_events_sync (self, mm_port_mbim_peek_device (mbim), FALSE);
+        /* If we did open the MBIM port during initialization, close it now */
+        if (mm_port_mbim_is_open (mbim))
+            mm_port_mbim_close (mbim, NULL, NULL);
+    }
 
     g_free (self->priv->caps_device_id);
     g_free (self->priv->caps_firmware_info);
     g_free (self->priv->current_operator_id);
     g_free (self->priv->current_operator_name);
 
-    mbim = mm_base_modem_peek_port_mbim (MM_BASE_MODEM (self));
-    /* If we did open the MBIM port during initialization, close it now */
-    if (mbim && mm_port_mbim_is_open (mbim)) {
-        mm_port_mbim_close (mbim, NULL, NULL);
-    }
-
     G_OBJECT_CLASS (mm_broadband_modem_mbim_parent_class)->finalize (object);
 }