ff479f
From d3d0969d7c366d6bb2f66501e61cbcd11a60face Mon Sep 17 00:00:00 2001
ff479f
From: Yu Watanabe <watanabe.yu+github@gmail.com>
ff479f
Date: Sun, 17 Apr 2022 07:05:07 +0900
ff479f
Subject: [PATCH] sd-bus: fix reference counter to be incremented
ff479f
ff479f
Fixes #23097.
ff479f
ff479f
(cherry picked from commit b21f237d996c8c18991a68e1204f060d07dc4745)
ff479f
ff479f
[msekleta: This commit also contains the hunk from c2d7dd35d2
ff479f
(in sd_bus_track_remove_name). I've decided to not backport that commit
ff479f
fully because of conflicts and because its was made largely irrelevant
ff479f
by 7f40cb7c86]
ff479f
ff479f
Related: #2084052
ff479f
---
ff479f
 src/libsystemd/sd-bus/bus-track.c | 15 +++++++--------
ff479f
 1 file changed, 7 insertions(+), 8 deletions(-)
ff479f
ff479f
diff --git a/src/libsystemd/sd-bus/bus-track.c b/src/libsystemd/sd-bus/bus-track.c
ff479f
index 16bf615f50..b1ec5ecbbb 100644
ff479f
--- a/src/libsystemd/sd-bus/bus-track.c
ff479f
+++ b/src/libsystemd/sd-bus/bus-track.c
ff479f
@@ -208,12 +208,12 @@ _public_ int sd_bus_track_add_name(sd_bus_track *track, const char *name) {
ff479f
         i = hashmap_get(track->names, name);
ff479f
         if (i) {
ff479f
                 if (track->recursive) {
ff479f
-                        unsigned k = track->n_ref + 1;
ff479f
+                        unsigned k = i->n_ref + 1;
ff479f
 
ff479f
-                        if (k < track->n_ref) /* Check for overflow */
ff479f
+                        if (k < i->n_ref) /* Check for overflow */
ff479f
                                 return -EOVERFLOW;
ff479f
 
ff479f
-                        track->n_ref = k;
ff479f
+                        i->n_ref = k;
ff479f
                 }
ff479f
 
ff479f
                 bus_track_remove_from_queue(track);
ff479f
@@ -281,14 +281,13 @@ _public_ int sd_bus_track_remove_name(sd_bus_track *track, const char *name) {
ff479f
         i = hashmap_get(track->names, name);
ff479f
         if (!i)
ff479f
                 return -EUNATCH;
ff479f
-        if (i->n_ref <= 0)
ff479f
-                return -EUNATCH;
ff479f
-
ff479f
-        i->n_ref--;
ff479f
 
ff479f
-        if (i->n_ref <= 0)
ff479f
+        assert(i->n_ref >=1);
ff479f
+        if (i->n_ref <= 1)
ff479f
                 return bus_track_remove_name_fully(track, name);
ff479f
 
ff479f
+        i->n_ref--;
ff479f
+
ff479f
         return 1;
ff479f
 }
ff479f