After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 756380 - Possible double free with SettingIPConfig.get_address using Python gi
Possible double free with SettingIPConfig.get_address using Python gi
Status: RESOLVED FIXED
Product: NetworkManager
Classification: Platform
Component: API
1.0.x
Other Linux
: Normal normal
: ---
Assigned To: NetworkManager maintainer(s)
NetworkManager maintainer(s)
Depends on:
Blocks:
 
 
Reported: 2015-10-11 08:48 UTC by Sunil Mohan Adapa
Modified: 2015-10-12 15:37 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
[PATCH] libnm: add missing GObject introspection annotations (1.39 KB, patch)
2015-10-12 08:27 UTC, Beniamino Galvani 		none Details | Review

Description Sunil Mohan Adapa 2015-10-11 08:48:25 UTC 
The following Python gi program crashes likely due to double free.
===========
#!/usr/bin/python3
import gi

gi.require_version('NM', '1.0')
from gi.repository import NM as nm

for _ in range(10000):
    settings = nm.SettingIP4Config.new()

    address = nm.IPAddress.new(2, '192.168.0.1', 24)
    settings.add_address(address)

    settings.get_address(0)
===========

With following message:

===========
(process:6088): libnm-CRITICAL **: nm_ip_address_unref: assertion 'address->refcount > 0' failed
Segmentation fault
===========

System information:

OS: Debian GNU/Linux Sid
network-manager: 1.0.6-1 (from repository packages)
python3-gi: 3.18.0-1 (from repository packages)
Comment 1 Beniamino Galvani 2015-10-12 08:27:16 UTC 
Created attachment 313105 [details] [review]
[PATCH] libnm: add missing GObject introspection annotations

The attached patch should fix the problem.
Comment 2 Thomas Haller 2015-10-12 10:08:33 UTC 
(In reply to Beniamino Galvani from comment #1)
> Created attachment 313105 [details] [review] [review]
> [PATCH] libnm: add missing GObject introspection annotations
> 
> The attached patch should fix the problem.

LGTM.

(Jirka was also looking into this...)
Comment 3 Jiri Klimes 2015-10-12 10:53:08 UTC 
nm_setting_ip_config_get_address() missed introspection annotation, which resulted in Python releasing the address. And then double-free occured when NM released the address again.

Already pushed:
master: 237030c libnm: specify (transfer none) introspection annotation (bgo #756380)
nm-1-0: ba46efd libnm: specify (transfer none) introspection annotation (bgo #756380)
Comment 4 Sunil Mohan Adapa 2015-10-12 15:37:49 UTC 
I confirm that the problem is indeed fixed by applying the patch on 1.0.6.  I checked for both get_address() and get_route() calls.

Thank you for the quick fix and the awesome NetworkManager.