From ce9388d72a710ffc4840572fecdfe7d9c0be0956 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 17 May 2021 15:23:57 +0900
Subject: [PATCH] network: fix possible message counter double decrement

When after_configure() for a request fails, then the request is not
removed from the queue at that time, and the link enters to failed
state. After that, if the link is reconfigured or its carrier is lost,
then the request is dropped from the queue, and the message_counter is
decreased. However, the counter is already or will be also decreased
when the corresponding netlink reply is received.
So, the counter is decreased twice.
---
 src/network/networkd-address.c             | 3 +++
 src/network/networkd-neighbor.c            | 3 +++
 src/network/networkd-nexthop.c             | 3 +++
 src/network/networkd-route.c               | 3 +++
 src/network/networkd-routing-policy-rule.c | 3 +++
 5 files changed, 15 insertions(+)

diff --git a/src/network/networkd-address.c b/src/network/networkd-address.c
index 5a3388c3c4a..daf959ec5f3 100644
--- a/src/network/networkd-address.c
+++ b/src/network/networkd-address.c
@@ -1149,6 +1149,9 @@ int request_process_address(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
diff --git a/src/network/networkd-neighbor.c b/src/network/networkd-neighbor.c
index 2afe71c5f8a..88620579ac5 100644
--- a/src/network/networkd-neighbor.c
+++ b/src/network/networkd-neighbor.c
@@ -479,6 +479,9 @@ int request_process_neighbor(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
diff --git a/src/network/networkd-nexthop.c b/src/network/networkd-nexthop.c
index 5c6c58356c6..013bddf30c3 100644
--- a/src/network/networkd-nexthop.c
+++ b/src/network/networkd-nexthop.c
@@ -751,6 +751,9 @@ int request_process_nexthop(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)
diff --git a/src/network/networkd-route.c b/src/network/networkd-route.c
index 8707e5c089d..e6c1d712659 100644
--- a/src/network/networkd-route.c
+++ b/src/network/networkd-route.c
@@ -1622,6 +1622,9 @@ int request_process_route(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 assert(n_routes > 0);
 
diff --git a/src/network/networkd-routing-policy-rule.c b/src/network/networkd-routing-policy-rule.c
index 9b9880d1da7..20512d24776 100644
--- a/src/network/networkd-routing-policy-rule.c
+++ b/src/network/networkd-routing-policy-rule.c
@@ -814,6 +814,9 @@ int request_process_routing_policy_rule(Request *req) {
         if (r < 0)
                 return r;
 
+        /* To prevent a double decrement on failure in after_configure(). */
+        req->message_counter = NULL;
+
         if (req->after_configure) {
                 r = req->after_configure(req, ret);
                 if (r < 0)