glib aux fix atomic pattern in nm_ref_string_unref()

NetworkManager.spec

@@ -51,7 +51,7 @@
 Name:             NetworkManager
 Version:          1.32.12
 Epoch:            1
-Release:          20
+Release:          21
 Summary:          Network Link Manager and User Applications
 License:          GPLv2+
 URL:              https://www.gnome.org/projects/NetworkManager/
@@ -68,6 +68,7 @@ Patch6001:        backport-libnm-fix-crash-on-failure-of-nm_vpn_plugin_info_new_
 Patch6002:        backport-core-reload-config-for-active-devices.patch
 Patch6003:        backport-libnm-fix-warning-when-setting-wrong-ethtool-ternary-value.patch
 Patch6004:        NetworkManager-Add-sw64-architecture.patch
+Patch6005:        backport-glib-aux-fix-atomic-pattern-in-nm_ref_string_unref.patch
 
 Patch9000:        revert-support-for-Aliyun-in-nm-cloud-setup-for-hard.patch
 
@@ -510,6 +511,12 @@ fi
 %{_datadir}/gtk-doc/html/NetworkManager/*
 
 %changelog
+* Fri Jul 26 2024 caokeming<caokeming@huawei.com> - 1:1.32.12-21
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC: glib-aux fix atomic pattern in nm_ref_string_unref()
+
 * Thu Jan 18 2024 gaoxingwang<gaoxingwang1@huawei.com> - 1:1.32.12-20
 - Type:bugfix
 - CVE:NA

backport-glib-aux-fix-atomic-pattern-in-nm_ref_string_unref.patch

@@ -0,0 +1,37 @@
+From 5f7a027f59f0dfd7b759c44106a9e3f3da7a8a57 Mon Sep 17 00:00:00 2001
+From: Thomas Haller <thaller@redhat.com>
+Date: Thu, 25 Jan 2024 15:16:31 +0100
+Subject: [PATCH] glib-aux: fix atomic pattern in nm_ref_string_unref()
+
+It's simply not valid to read the ref-count without an atomic.
+The compiler might optimize out the assignment to "r" and read the
+_ref_count field multiple times. Thereby, we might at first appear
+to be larger than > 1, and later pass 1 to compare-and-exchange.
+
+We need an atomic get here.
+
+Fixes: 19d402782488 ('refstr: inline nm_ref_string_{ref,unref}()')
+
+Conflict:NA
+Reference:https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/1847
+---
+ src/libnm-glib-aux/nm-ref-string.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/libnm-glib-aux/nm-ref-string.h b/src/libnm-glib-aux/nm-ref-string.h
+index c7cfe87fd0..45313b394e 100644
+--- a/src/libnm-glib-aux/nm-ref-string.h
++++ b/src/libnm-glib-aux/nm-ref-string.h
+@@ -83,7 +83,8 @@ nm_ref_string_unref(NMRefString *rstr)
+ 
+     /* fast-path: first try to decrement the ref-count without bringing it
+      * to zero. */
+-    r = rstr->_ref_count;
++    r = g_atomic_int_get(&rstr->_ref_count);
++
+     if (G_LIKELY(r > 1 && g_atomic_int_compare_and_exchange(&rstr->_ref_count, r, r - 1)))
+         return;
+ 
+-- 
+GitLab
+