Crashes in g_hash_table_iter_next call

[Sebastien Fabre]

Hello,

With different versions of ModemManager (1.6.12, 1.6.4, 1.4.2), we have seen (rarely) segfault crashes in g_hash_table_iter_next called by mm_base_modem_find_ports because the hash table corresponding to ports is NULL.
When the crash occurs, in mm_base_modem_find_ports (mm-base-modem.c),  "self->priv->ports" and "self->priv->authp"  are NULL. It seems that they can be NULL only if dispose was called before but the reference count of the object is not equal to 0 (7 for example). Maybe because g_object_run_dispose was called.
Unfortunately, we do not have a method to reproduce these crashes even if it seems to occur at modem unplug (huawei models - broadband).
Is it a known problem?

ModemManager 1.6.12 simplified stacktrace:
g_hash_table_iter_next (ghash.c)
mm_base_modem_find_ports (mm-base-modem.c)
get_at_port_list (mm-broadband-modem-huawei.c)
set_voice_unsolicited_events_handlers (mm-broadband-modem-huawei.c)
parent_voice_setup_unsolicited_events_ready (mm-broadband-modem-huawei.c)
g_simple_async_result_complete (gsimpleasyncresult.c)
...

ModemManager 1.6.4 simplified stacktrace :
g_hash_table_iter_next
mm_base_modem_find_ports
get_at_port_list (mm-broadband-modem-huawei.c)
enable_disable_unsolicited_rfswitch_event_handler (mm-broadband-modem-huawei.c)
huawei_rfswitch_check_ready (mm-broadband-modem-huawei.c)
g_simple_async_result_complete (gsimpleasyncresult.c)
...

ModemManager 1.4.2 simplified stacktrace :
g_hash_table_iter_next (ghash.c)
mm_base_modem_find_ports (mm-base-modem.c)
get_at_port_list (mm-broadband-modem-huawei.c)
set_ignored_unsolicited_events_handlers (mm-broadband-modem-huawei.c)
setup_ports (mm-broadband-modem-huawei.c)
initialize_step (mm-broadband-modem.c)
restart_initialize_idle (mm-iface-modem.c)
g_main_dispatch (gmain.c)
...

Thanks,


Sebastien Fabre
Embedded Software Engineer
[http://www.sigfox.com/static/media/signature_sigfox_logo_nov16.png]<http://www.sigfox.com>     Bâtiment E-volution - 425, rue Jean Rostand
31670 Labège, France
sebastien.fabre at sigfox.com<mailto:sebastien.fabre at sigfox.com>
sigfox.com<http://www.sigfox.com>
[http://www.sigfox.com/static/media/T.png] <https://twitter.com/sigfox> [http://www.sigfox.com/static/media/F.png]  <http://www.facebook.com/sigfox> [http://www.sigfox.com/static/media/L.png]  <http://www.linkedin.com/company/2731408> [http://www.sigfox.com/static/media/Y.png]  <https://www.youtube.com/sigfox>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20181126/eb13aa4c/attachment.html>