Comment 12 for bug 259503

Revision history for this message
Alexander Sack (asac) wrote :

What appears to happen here is that NM uses a scheduled callback to perform actions on device objects. however, those device objects are neither refcounted nor are the callbacks cancelled when the device goes down and we end up accessing freed memory in the callback.