[systemd-devel] [PATCH] Fix a fatal dbus abort in bus_manager_message_handler()

[Colin Walters]

On Wed, 2012-10-31 at 11:53 +0100, Eelco Dolstra wrote:
> If ListUnitFiles fails, or an OOM occurs, then dbus_message_unref()
> will be called twice on "reply", causing systemd to crash.  So remove
> the calls to dbus_message_unref(); these are unnecessary because of
> the cleanup attribute on "reply".
> ---
>  src/core/dbus-manager.c | 2 --
>  1 file changed, 2 deletions(-)
> 
> diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
> index 2010241..0418e35 100644
> --- a/src/core/dbus-manager.c
> +++ b/src/core/dbus-manager.c
> @@ -495,7 +495,6 @@ static DBusMessage *message_from_file_changes(
>          return reply;
>  
>  oom:
> -        dbus_message_unref(reply);
>          return NULL;
>  }

This first change looks wrong to me - I don't see a cleanup attribute on
the reply member in git master at least - v195-103-g173fa08 here.

> @@ -1436,7 +1435,6 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
>                  r = unit_file_get_list(m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER, NULL, h);
>                  if (r < 0) {
>                          unit_file_list_free(h);
> -                        dbus_message_unref(reply);
>                          return bus_send_error_reply(connection, message, NULL, r);
>                  }

This looks correct.