supplicant: fix crash setting supplicant state down

When we receive a "InterfaceRemoved" signal, we will end up calling
set_state_down(). That emits a "state" change signal, which causes
NMDeviceWifi to unref the supplicant interface. This may already
give up the last reference, and we cleanup the supplicant state
(by again calling set_state_down()). When we return, set_state_down()
will crash because it operates on an already destroyed instance.

Avoid that by keeping a reference to the interface during set_state_down().

Fixes: b83f07916a54 ('supplicant: large rework of wpa_supplicant handling')

https://bugzilla.redhat.com/show_bug.cgi?id=1815058

1 files changed, 1 insertions, 0 deletions

diff --git a/src/supplicant/nm-supplicant-interface.c b/src/supplicant/nm-supplicant-interface.c
index 6edeef682a..42179246c8 100644
--- a/src/supplicant/nm-supplicant-interface.c
+++ b/src/supplicant/nm-supplicant-interface.c
@@ -947,6 +947,7 @@ set_state_down (NMSupplicantInterface *self,
                 gboolean force_remove_from_supplicant,
                 const char *reason)
 {
+	_nm_unused gs_unref_object NMSupplicantInterface *self_keep_alive = g_object_ref (self);
 	NMSupplicantInterfacePrivate *priv = NM_SUPPLICANT_INTERFACE_GET_PRIVATE (self);
 	NMSupplicantBssInfo *bss_info;
 	NMSupplicantPeerInfo *peer_info;