core: don't accidentally unref a varlink connection twice

Let's make sure that our close handler unrefs a connection again that we
are already unreffing a few stack frames up by invalidating the pointer
first, and dropping the ref counter only after that.

Replaces: 39ad3f1c092b5dffcbb4b1d12eb9ca407f010a3c

Fixes: #18025
(cherry picked from commit d65e974e67e47222cdebd9d0b6becd6642547ce2)
(cherry picked from commit 68da6997a9323c127a45ca019d32fa97ff0d7cca)

1 files changed, 5 insertions, 2 deletions

diff --git a/src/core/core-varlink.c b/src/core/core-varlink.c
index 96b378da8e..f08dac766f 100644
--- a/src/core/core-varlink.c
+++ b/src/core/core-varlink.c
@@ -475,8 +475,11 @@ int manager_varlink_init(Manager *m) {
 void manager_varlink_done(Manager *m) {
         assert(m);
 
-        /* Send the final message if we still have a subscribe request open. */
-        m->managed_oom_varlink_request = varlink_close_unref(m->managed_oom_varlink_request);
+        /* Explicitly close the varlink connection to oomd. Note we first take the varlink connection out of
+         * the manager, and only then disconnect it — in two steps – so that we don't end up accidentally
+         * unreffing it twice. After all, closing the connection might cause the disconnect handler we
+         * installed (vl_disconnect() above) to be called, where we will unref it too. */
+        varlink_close_unref(TAKE_PTR(m->managed_oom_varlink_request));
 
         m->varlink_server = varlink_server_unref(m->varlink_server);
 }