libnm: disconnect devices' signals when disposing manager

We connect signal handlers to devices when they appear, but don't
disconnect the handlers when the manager instance is destroyed. This
can cause crashes as device_ac_changed() is called on an invalid
manager instance.

Disconnect the handlers from dispose().

https://bugzilla.redhat.com/show_bug.cgi?id=1383758

1 files changed, 15 insertions, 7 deletions

diff --git a/libnm/nm-manager.c b/libnm/nm-manager.c
index d9d21b823d..01ed4fa50a 100644
--- a/libnm/nm-manager.c
+++ b/libnm/nm-manager.c
@@ -1201,12 +1201,11 @@ free_devices (NMManager *manager, gboolean in_dispose)
 	if (in_dispose) {
 		priv->devices = NULL;
 		priv->all_devices = NULL;
-		return;
+	} else {
+		priv->devices = g_ptr_array_new_with_free_func (g_object_unref);
+		priv->all_devices = g_ptr_array_new_with_free_func (g_object_unref);
 	}
 
-	priv->devices = g_ptr_array_new_with_free_func (g_object_unref);
-	priv->all_devices = g_ptr_array_new_with_free_func (g_object_unref);
-
 	if (all_devices && all_devices->len > 0)
 		devices = all_devices;
 	else if (real_devices && real_devices->len > 0)
@@ -1222,14 +1221,23 @@ free_devices (NMManager *manager, gboolean in_dispose)
 						goto next;
 				}
 			}
-			g_signal_emit (manager, signals[DEVICE_REMOVED], 0, d);
+			if (in_dispose)
+				device_removed (manager, d);
+			else
+				g_signal_emit (manager, signals[DEVICE_REMOVED], 0, d);
 next:
 			;
 		}
 	}
 	if (devices) {
-		for (i = 0; i < devices->len; i++)
-			g_signal_emit (manager, signals[DEVICE_REMOVED], 0, devices->pdata[i]);
+		for (i = 0; i < devices->len; i++) {
+			NMDevice *d = devices->pdata[i];
+
+			if (in_dispose)
+				device_removed (manager, d);
+			else
+				g_signal_emit (manager, signals[DEVICE_REMOVED], 0, d);
+		}
 	}
 }