sablink-distro/net-misc/networkmanager/files/networkmanager-0.6.4-fix-various-memleaks.patch

--- a/src/NetworkManager.c
+++ b/src/NetworkManager.c
@@ -485,8 +485,8 @@
 {
 	g_return_if_fail (dev != NULL);
 
-	nm_device_set_removed (dev, TRUE);
-	nm_device_deactivate (dev);
+	nm_device_set_removed (dev, TRUE);	
+	nm_device_stop (dev);
 	g_object_unref (G_OBJECT (dev));
 }
 
@@ -507,20 +507,28 @@
 	if ((req = nm_vpn_manager_get_vpn_act_request (data->vpn_manager)))
 		nm_vpn_manager_deactivate_vpn_connection (data->vpn_manager, nm_vpn_act_request_get_parent_dev (req));
 
-	if (data->netlink_monitor)
-	{
-		g_object_unref (G_OBJECT (data->netlink_monitor));
-		data->netlink_monitor = NULL;
-	}
-
 	/* Stop and destroy all devices */
 	nm_lock_mutex (data->dev_list_mutex, __FUNCTION__);
 	g_slist_foreach (data->dev_list, (GFunc) device_stop_and_free, NULL);
 	g_slist_free (data->dev_list);
+	data->dev_list = NULL;
 	nm_unlock_mutex (data->dev_list_mutex, __FUNCTION__);
 
+	/* device_stop_and_free() deactivates devices, which triggers state change
+	   signals. Without cleaning the queue, they never get the chance to fire,
+	   keeping the device references alive.
+	*/
+	while (g_main_context_pending (data->main_context))
+		g_main_context_iteration (data->main_context, TRUE);
+
 	g_mutex_free (data->dev_list_mutex);
 
+	if (data->netlink_monitor)
+	{
+		g_object_unref (G_OBJECT (data->netlink_monitor));
+		data->netlink_monitor = NULL;
+	}
+
 	nm_ap_list_unref (data->allowed_ap_list);
 	nm_ap_list_unref (data->invalid_ap_list);
 
@@ -536,7 +544,7 @@
 	nm_dbus_method_list_free (data->net_methods);
 	nm_dbus_method_list_free (data->vpn_methods);
 
-	g_io_channel_unref(data->sigterm_iochannel);
+	g_io_channel_unref (data->sigterm_iochannel);
 
 	nm_hal_deinit (data);
 
--- a/src/NetworkManagerAP.c
+++ b/src/NetworkManagerAP.c
@@ -537,6 +537,7 @@
 
 	/* Free existing list */
 	g_slist_foreach (ap->user_addresses, (GFunc) g_free, NULL);
+	g_slist_free (ap->user_addresses);
 
 	/* Copy new list and set as our own */
 	for (elt = list; elt; elt = g_slist_next (elt))
--- a/src/NetworkManagerDbus.c
+++ b/src/NetworkManagerDbus.c
@@ -207,9 +207,9 @@
 static gboolean nm_dbus_signal_device_status_change (gpointer user_data)
 {
 	NMStatusChangeData *cb_data = (NMStatusChangeData *)user_data;
-	DBusMessage *		message;
-	char *			dev_path;
-	const char *		sig = NULL;
+	DBusMessage *		message = NULL;
+	char *			dev_path = NULL;
+	const char *		sig;
 	int				i = 0;
 
 	g_return_val_if_fail (cb_data->data, FALSE);
@@ -220,16 +220,15 @@
 		i++;
 
 	if (!(sig = dev_status_signals[i].signal))
-		return FALSE;
+		goto out;
 
 	if (!(dev_path = nm_dbus_get_object_path_for_device (cb_data->dev)))
-		return FALSE;
+		goto out;
 
 	if (!(message = dbus_message_new_signal (NM_DBUS_PATH, NM_DBUS_INTERFACE, sig)))
 	{
 		nm_warning ("nm_dbus_signal_device_status_change(): Not enough memory for new dbus message!");
-		g_free (dev_path);
-		return FALSE;
+		goto out;
 	}
 
 	/* If the device was wireless, attach the name of the wireless network that failed to activate */
@@ -238,18 +237,21 @@
 		const char *essid = nm_ap_get_essid (cb_data->ap);
 		if (essid)
 			dbus_message_append_args (message, DBUS_TYPE_OBJECT_PATH, &dev_path, DBUS_TYPE_STRING, &essid, DBUS_TYPE_INVALID);
-		nm_ap_unref (cb_data->ap);
 	}
 	else
 		dbus_message_append_args (message, DBUS_TYPE_OBJECT_PATH, &dev_path, DBUS_TYPE_INVALID);
 
-	g_free (dev_path);
-
 	if (!dbus_connection_send (cb_data->data->dbus_connection, message, NULL))
 		nm_warning ("nm_dbus_signal_device_status_change(): Could not raise the signal!");
 
-	dbus_message_unref (message);
+ out:
+	if (message)
+		dbus_message_unref (message);
 
+	if (cb_data->ap)
+		nm_ap_unref (cb_data->ap);
+
+	g_free (dev_path);
 	g_object_unref (G_OBJECT (cb_data->dev));
 	g_free (cb_data);
 
--- a/src/NetworkManagerPolicy.c
+++ b/src/NetworkManagerPolicy.c
@@ -66,6 +66,7 @@
 
 	nm_device_activation_success_handler (dev, req);
 
+	nm_act_request_unref (req);
 	nm_info ("Activation (%s) successful, device activated.", nm_device_get_iface (dev));
 	nm_dbus_schedule_device_status_change_signal (data, dev, ap, DEVICE_NOW_ACTIVE);
 	nm_schedule_state_change_signal_broadcast (data);
@@ -93,6 +94,7 @@
 	g_assert (dev);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_ACTIVATED);
+	nm_act_request_ref (req);
 
 	source = g_idle_source_new ();
 	g_source_set_priority (source, G_PRIORITY_HIGH_IDLE);
@@ -135,6 +137,8 @@
 	nm_schedule_state_change_signal_broadcast (data);
 	nm_policy_schedule_device_change_check (data);
 
+	nm_act_request_unref (req);
+
 	return FALSE;
 }
 
@@ -158,6 +162,7 @@
 	g_assert (dev);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_FAILED);
+	nm_act_request_ref (req);
 
 	source = g_idle_source_new ();
 	g_source_set_priority (source, G_PRIORITY_HIGH_IDLE);
@@ -428,6 +433,7 @@
 		{
 			nm_info ("Will activate connection '%s%s%s'.", nm_device_get_iface (new_dev), ap ? "/" : "", ap ? nm_ap_get_essid (ap) : "");
 			nm_policy_schedule_device_activation (act_req);
+			nm_act_request_unref (act_req);
 		}
 	}
 
@@ -490,10 +496,11 @@
 		nm_device_deactivate (old_dev);
 
 	new_dev = nm_act_request_get_dev (req);
-	if (nm_device_is_activating (new_dev))
-		return FALSE;
 
-	nm_device_activation_start (req);
+	if (!nm_device_is_activating (new_dev))
+		nm_device_activation_start (req);
+
+	nm_act_request_unref (req);
 
 	return FALSE;
 }
@@ -518,6 +525,8 @@
 
 	dev = nm_act_request_get_dev (req);
 	g_assert (dev);
+
+	nm_act_request_ref (req);
 
 	source = g_idle_source_new ();
 	g_source_set_priority (source, G_PRIORITY_HIGH_IDLE);
--- a/src/nm-activation-request.c
+++ b/src/nm-activation-request.c
@@ -94,6 +94,9 @@
 		if (req->ap)
 			nm_ap_unref (req->ap);
 
+		if (req->ip4_config)
+			nm_ip4_config_unref (req->ip4_config);
+
 		if (req->dhcp_timeout > 0)
 		{
 			GSource *	source = g_main_context_find_source_by_id (req->data->main_context, req->dhcp_timeout);
--- a/src/nm-dbus-nm.c
+++ b/src/nm-dbus-nm.c
@@ -229,6 +229,7 @@
 	DBusMessage *		reply = NULL;
 	char *			dev_path;
 	NMAccessPoint *	ap = NULL;
+	NMActRequest * req;
 	DBusMessageIter	iter;
 
 	g_return_val_if_fail (connection != NULL, NULL);
@@ -304,7 +305,9 @@
 
 	nm_device_deactivate (dev);
 	nm_schedule_state_change_signal_broadcast (data->data);
-	nm_policy_schedule_device_activation (nm_act_request_new (data->data, dev, ap, TRUE));
+	req = nm_act_request_new (data->data, dev, ap, TRUE);
+	nm_policy_schedule_device_activation (req);
+	nm_act_request_unref (req);
 
 	/* empty success message */
 	reply = dbus_message_new_method_return (message);
@@ -337,6 +340,7 @@
 	NMAccessPoint *	new_ap = NULL;
 	NMAPSecurity * 	security = NULL;
 	char *			essid = NULL;
+	NMActRequest * req;
 	DBusMessageIter	iter;
 
 	g_return_val_if_fail (connection != NULL, NULL);
@@ -394,7 +398,9 @@
 	g_object_unref (G_OBJECT (security));
 	nm_ap_set_user_created (new_ap, TRUE);
 
-	nm_policy_schedule_device_activation (nm_act_request_new (data->data, dev, new_ap, TRUE));
+	req = nm_act_request_new (data->data, dev, new_ap, TRUE);
+	nm_policy_schedule_device_activation (req);
+	nm_act_request_unref (req);
 
 out:
 	return reply;
--- a/src/nm-dbus-nmi.c
+++ b/src/nm-dbus-nmi.c
@@ -57,8 +57,6 @@
 	ap = nm_act_request_get_ap (req);
 	g_assert (ap);
 
-	dbus_pending_call_ref (pcall);
-
 	if (!dbus_pending_call_get_completed (pcall))
 		goto out;
 
@@ -100,7 +98,8 @@
 	dbus_message_iter_init (reply, &iter);
 	if ((security = nm_ap_security_new_deserialize (&iter)))
 	{
-		nm_ap_set_security (ap, security);	
+		nm_ap_set_security (ap, security);
+		g_object_unref (G_OBJECT (security));	/* set_security copies the object */
 		nm_device_activate_schedule_stage1_device_prepare (req);
 	}
 	nm_act_request_set_user_key_pending_call (req, NULL);
@@ -352,8 +351,6 @@
 	g_return_if_fail (cb_data->network != NULL);
 	g_return_if_fail (cb_data->list != NULL);
 
-	dbus_pending_call_ref (pcall);
-
 	if (!(reply = dbus_pending_call_steal_reply (pcall)))
 		goto out;
 
@@ -448,11 +445,17 @@
 
 	if ((list_ap = nm_ap_list_get_ap_by_essid (cb_data->list, essid)))
 	{
+		GSList *user_addresses;
+
 		nm_ap_set_essid (list_ap, nm_ap_get_essid (ap));
 		nm_ap_set_timestamp_via_timestamp (list_ap, nm_ap_get_timestamp (ap));
 		nm_ap_set_trusted (list_ap, nm_ap_get_trusted (ap));
 		nm_ap_set_security (list_ap, nm_ap_get_security (ap));
-		nm_ap_set_user_addresses (list_ap, nm_ap_get_user_addresses (ap));
+
+		user_addresses = nm_ap_get_user_addresses (ap);
+		nm_ap_set_user_addresses (list_ap, user_addresses);
+		g_slist_foreach (user_addresses, (GFunc) g_free, NULL);
+		g_slist_free (user_addresses);
 	}
 	else
 	{
@@ -490,8 +493,6 @@
 	g_return_if_fail (cb_data->list != NULL);
 	g_return_if_fail (cb_data->data != NULL);
 
-	dbus_pending_call_ref (pcall);
-
 	if (!dbus_pending_call_get_completed (pcall))
 	{
 		nm_warning ("pending call was not completed.");
@@ -614,6 +615,7 @@
 	cb_data->data = data;
 	cb_data->network = g_strdup (network);
 	cb_data->list = data->allowed_ap_list;
+	nm_ap_list_ref (cb_data->list);
 
 	dbus_message_append_args (message, DBUS_TYPE_STRING, &network, DBUS_TYPE_INT32, &type_as_int32, DBUS_TYPE_INVALID);
 	dbus_connection_send_with_reply (connection, message, &pcall, -1);
--- a/src/nm-device-802-11-wireless.c
+++ b/src/nm-device-802-11-wireless.c
@@ -103,6 +103,8 @@
 
 static void	nm_device_802_11_wireless_ap_list_clear (NMDevice80211Wireless *self);
 
+static void nm_device_802_11_wireless_scan_done (gpointer user_data);
+
 static gboolean nm_device_802_11_wireless_scan (gpointer user_data);
 
 static void	cancel_scan_results_timeout (NMDevice80211Wireless *self);
@@ -461,6 +463,16 @@
 	int					len;
 } WirelessEventCBData;
 
+static void
+wireless_event_cb_data_free (WirelessEventCBData *data)
+{
+	if (data) {
+		g_object_unref (data->dev);
+		g_free (data->data);
+		g_free (data);
+	}
+}
+
 static gboolean
 wireless_event_helper (gpointer user_data)
 {
@@ -532,9 +544,7 @@
 		}
 		pos += iwe->len;
 	}
-	g_object_unref (G_OBJECT (self));
-	g_free (cb_data->data);
-	g_free (cb_data);
+
 	return FALSE;
 }
 
@@ -553,15 +563,14 @@
 		return;
 
 	cb_data = g_malloc0 (sizeof (WirelessEventCBData));
-	cb_data->dev = self;
-	g_object_ref (G_OBJECT (self));
+	cb_data->dev = g_object_ref (G_OBJECT (self));
 	cb_data->data = g_malloc (data_len);
 	memcpy (cb_data->data, data, data_len);
 	cb_data->len = data_len;
 
 	source = g_idle_source_new ();
 	g_source_set_callback (source, (GSourceFunc) wireless_event_helper,
-			cb_data, NULL);
+			cb_data, (GDestroyNotify) wireless_event_cb_data_free);
 	g_source_attach (source, nm_device_get_main_context (NM_DEVICE (self)));
 	g_source_unref (source);
 }
@@ -610,9 +619,12 @@
 	{
 		self->priv->pending_scan = g_idle_source_new ();
 		g_source_set_callback (self->priv->pending_scan,
-				nm_device_802_11_wireless_scan, self, NULL);
+							   nm_device_802_11_wireless_scan,
+							   self,
+							   nm_device_802_11_wireless_scan_done);
 		source_id = g_source_attach (self->priv->pending_scan,
 				nm_device_get_main_context (dev));
+		g_source_unref (self->priv->pending_scan);
 	}
 
 	/* Peridoically update link status and signal strength */
@@ -945,6 +957,10 @@
 			return NULL;
 		}
 
+		/* The 'else' block will create a new security and we'll going to unref the
+		   security at the end of this function. So make sure we don't free the original. */
+		g_object_ref (security);
+
 		/* User chose a network we haven't seen in a scan, so create a
 		 * "fake" access point and add it to the scan list.
 		 */
@@ -974,6 +990,8 @@
 	nm_ap_set_security (ap, security);
 	nm_ap_add_capabilities_from_security (ap, security);
 
+	g_object_unref (security);
+
 	return ap;
 }
 
@@ -1832,10 +1850,7 @@
 
 	self = NM_DEVICE_802_11_WIRELESS (cb_data->dev);
 	if (!self || !cb_data->results)
-	{
-		free_process_scan_cb_data (cb_data);
 		return FALSE;
-	}
 
 	iface = nm_device_get_iface (NM_DEVICE (self));
 	app_data = nm_device_get_app_data (NM_DEVICE (self));
@@ -1901,8 +1916,6 @@
 
 	nm_policy_schedule_device_change_check (app_data);
 
-	free_process_scan_cb_data (cb_data);
-
 	return FALSE;
 }
 
@@ -1993,7 +2006,8 @@
 		scan_results->results = buf;
 		scan_results->results_len = buflen;
 
-		g_source_set_callback (convert_source, convert_scan_results, scan_results, NULL);
+		g_source_set_callback (convert_source, convert_scan_results, scan_results,
+							   (GDestroyNotify) free_process_scan_cb_data);
 		g_source_attach (convert_source, app_data->main_context);
 		g_source_unref (convert_source);
 		g_get_current_time (&cur_time);
@@ -2002,6 +2016,15 @@
 }
 
 
+static void
+scan_results_timeout_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->scan_timeout = NULL;
+}
+
+
 /*
  * scan_results_timeout
  *
@@ -2016,9 +2039,8 @@
 
 	request_and_convert_scan_results (self);
 	schedule_scan (self);
-	g_source_unref (self->priv->scan_timeout);  /* Balance g_timeout_source_new() */
-	self->priv->scan_timeout = NULL;
-	return FALSE;  /* Balance g_source_attach(), destroyed on return */
+
+	return FALSE;
 }
 
 
@@ -2041,9 +2063,12 @@
 	/* Wait 10 seconds for scan results */
 	self->priv->scan_timeout = g_timeout_source_new (10000);
 	g_source_set_callback (self->priv->scan_timeout,
-			(GSourceFunc) scan_results_timeout, self, NULL);
+						   (GSourceFunc) scan_results_timeout,
+						   self,
+						   scan_results_timeout_done);
 	context = nm_device_get_main_context (NM_DEVICE (self));
 	g_source_attach (self->priv->scan_timeout, context);
+	g_source_unref (self->priv->scan_timeout);
 }
 
 
@@ -2060,13 +2085,21 @@
 
 	if (self->priv->scan_timeout)
 	{
-		g_source_destroy (self->priv->scan_timeout);  /* Balance g_source_attach() */
-		g_source_unref (self->priv->scan_timeout); /* Balance g_timeout_source_new() */
+		g_source_destroy (self->priv->scan_timeout); /* Balance g_timeout_source_new() */
 		self->priv->scan_timeout = NULL;
 	}
 }
 
 
+static void
+nm_device_802_11_wireless_scan_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->pending_scan = NULL;
+}
+
+
 /*
  * nm_device_802_11_wireless_scan
  *
@@ -2091,7 +2124,6 @@
 	if (!(caps & NM_DEVICE_CAP_NM_SUPPORTED) || !(caps & NM_DEVICE_CAP_WIRELESS_SCAN))
 		goto out;
 
-	g_source_unref (self->priv->pending_scan);	/* Balance g_timeout_source_new() */
 	self->priv->pending_scan = NULL;
 
 	/* Reschedule ourselves if all wireless is disabled, we're asleep,
@@ -2184,8 +2216,12 @@
 	cancel_pending_scan (self);
 
 	self->priv->pending_scan = g_timeout_source_new (self->priv->scan_interval * 1000);
-	g_source_set_callback (self->priv->pending_scan, nm_device_802_11_wireless_scan, self, NULL);
+	g_source_set_callback (self->priv->pending_scan,
+						   nm_device_802_11_wireless_scan,
+						   self,
+						   nm_device_802_11_wireless_scan_done);
 	g_source_attach (self->priv->pending_scan, nm_device_get_main_context (NM_DEVICE (self)));
+	g_source_unref (self->priv->pending_scan);
 }
 
 
@@ -2197,8 +2233,7 @@
 	self->priv->scanning = FALSE;
 	if (self->priv->pending_scan)
 	{
-		g_source_destroy (self->priv->pending_scan);  /* Balance g_source_attach() */
-		g_source_unref (self->priv->pending_scan);  /* Balance g_timeout_source_new() */
+		g_source_destroy (self->priv->pending_scan);
 		self->priv->pending_scan = NULL;
 	}
 }
@@ -2485,6 +2520,14 @@
 }
 
 static void
+supplicant_watch_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->supplicant.watch = NULL;
+}
+
+static void
 supplicant_watch_cb (GPid pid,
                      gint status,
                      gpointer user_data)
@@ -2509,6 +2552,15 @@
 }
 
 
+static void
+link_timeout_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->link_timeout = NULL;
+}
+
+
 /*
  * link_timeout_cb
  *
@@ -2550,6 +2602,15 @@
 }
 
 
+static void
+supplicant_status_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->supplicant.status = NULL;
+}
+
+
 #define MESSAGE_LEN	2048
 
 static gboolean
@@ -2611,8 +2672,12 @@
 			{
 				GMainContext *	context = nm_device_get_main_context (dev);
 				self->priv->link_timeout = g_timeout_source_new (8000);
-				g_source_set_callback (self->priv->link_timeout, link_timeout_cb, self, NULL);
+				g_source_set_callback (self->priv->link_timeout,
+									   link_timeout_cb,
+									   self,
+									   link_timeout_done);
 				g_source_attach (self->priv->link_timeout, context);
+				g_source_unref (self->priv->link_timeout);
 			}
 		}
 		else
@@ -2638,6 +2703,15 @@
 }
 
 
+static void
+supplicant_timeout_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->supplicant.timeout = NULL;
+}
+
+
 /*
  * supplicant_timeout_cb
  *
@@ -2680,6 +2754,15 @@
 }
 
 
+static void
+supplicant_log_stdout_done (gpointer user_data)
+{
+	NMDevice80211Wireless *device = NM_DEVICE_802_11_WIRELESS (user_data);
+
+	device->priv->supplicant.stdout = NULL;
+}
+
+
 /*
  * supplicant_log_stdout
  *
@@ -2792,18 +2875,26 @@
 		g_get_charset (&charset);
 		g_io_channel_set_encoding (channel, charset, NULL);
 		self->priv->supplicant.stdout = g_io_create_watch (channel, G_IO_IN | G_IO_ERR);
+		g_io_channel_unref (channel);
 		g_source_set_priority (self->priv->supplicant.stdout, G_PRIORITY_LOW);
-		g_source_set_callback (self->priv->supplicant.stdout, (GSourceFunc) supplicant_log_stdout, self, NULL);
+		g_source_set_callback (self->priv->supplicant.stdout,
+							   (GSourceFunc) supplicant_log_stdout,
+							   self,
+							   supplicant_log_stdout_done);
 		g_source_attach (self->priv->supplicant.stdout, nm_device_get_main_context (NM_DEVICE (self)));
-		g_io_channel_unref (channel);
+		g_source_unref (self->priv->supplicant.stdout);
 
 		/* Monitor the child process so we know when it stops */
 		self->priv->supplicant.pid = pid;
 		if (self->priv->supplicant.watch)
 			g_source_destroy (self->priv->supplicant.watch);
 		self->priv->supplicant.watch = g_child_watch_source_new (pid);
-		g_source_set_callback (self->priv->supplicant.watch, (GSourceFunc) supplicant_watch_cb, self, NULL);
+		g_source_set_callback (self->priv->supplicant.watch,
+							   (GSourceFunc) supplicant_watch_cb,
+							   self,
+							   supplicant_watch_done);
 		g_source_attach (self->priv->supplicant.watch, nm_device_get_main_context (NM_DEVICE (self)));
+		g_source_unref (self->priv->supplicant.watch);
 	}
 
 	return success;
@@ -2869,7 +2960,7 @@
 	const char *		essid;
 	struct wpa_ctrl *	ctrl;
 	gboolean			is_adhoc;
-	const char *		hex_essid;
+	char *		hex_essid;
 	const char *		ap_scan = "AP_SCAN 1";
 	guint32			caps;
 	gboolean			supports_wpa;
@@ -2959,6 +3050,8 @@
 
 	success = TRUE;
 out:
+	g_free (hex_essid);
+
 	return success;
 }
 
@@ -2983,13 +3076,22 @@
 	context = nm_device_get_main_context (NM_DEVICE (self));
 	channel = g_io_channel_unix_new (fd);
 	self->priv->supplicant.status = g_io_create_watch (channel, G_IO_IN);
-	g_source_set_callback (self->priv->supplicant.status, (GSourceFunc) supplicant_status_cb, self, NULL);
+	g_io_channel_unref (channel);
+	g_source_set_callback (self->priv->supplicant.status,
+						   (GSourceFunc) supplicant_status_cb,
+						   self,
+						   supplicant_status_done);
 	g_source_attach (self->priv->supplicant.status, context);
+	g_source_unref (self->priv->supplicant.status);
 
 	/* Set up a timeout on the association to kill it after get_supplicant_time() seconds */
 	self->priv->supplicant.timeout = g_timeout_source_new (get_supplicant_timeout (self) * 1000);
-	g_source_set_callback (self->priv->supplicant.timeout, supplicant_timeout_cb, self, NULL);
+	g_source_set_callback (self->priv->supplicant.timeout,
+						   supplicant_timeout_cb,
+						   self,
+						   supplicant_timeout_done);
 	g_source_attach (self->priv->supplicant.timeout, context);
+	g_source_unref (self->priv->supplicant.timeout);
 
 	success = TRUE;
 
@@ -3310,6 +3412,8 @@
 
 	self->priv->dispose_has_run = TRUE;
 
+	g_free (self->priv->cur_essid);
+
 	/* Only do this part of the cleanup if the object is initialized */
 	if (self->priv->is_initialized)
 	{
@@ -3319,7 +3423,6 @@
 	}
 
 	cancel_scan_results_timeout (self);
-	cancel_pending_scan (self);
 
 	g_signal_handler_disconnect (G_OBJECT (data->netlink_monitor),
 		self->priv->wireless_event_id);
--- a/src/nm-device.c	2 Nov 2006 16:32:45 -0000	1.17.2.8
+++ b/src/nm-device.c	7 Nov 2006 13:14:35 -0000
@@ -621,7 +621,9 @@
 			if (act_dev && nm_device_is_802_11_wireless (act_dev) && act_dev_req && !nm_act_request_get_user_requested (act_dev_req))
 				do_switch = TRUE;
 
-			if (do_switch && (act_req = nm_act_request_new (app_data, self, NULL, TRUE)))
+			/* FIXME: Why is this activation request created here and never used? */
+			/* if (do_switch && (act_req = nm_act_request_new (app_data, self, NULL, TRUE))) */
+			if (do_switch)
 			{
 				nm_info ("Will activate wired connection '%s' because it now has a link.", nm_device_get_iface (self));
 				nm_policy_schedule_device_change_check (app_data);
@@ -714,6 +716,7 @@
 	nm_device_activate_schedule_stage2_device_config (req);
 
 out:
+	nm_act_request_unref (req);
 	nm_info ("Activation (%s) Stage 1 of 5 (Device Prepare) complete.", iface);
 	return FALSE;
 }
@@ -737,6 +740,7 @@
 	g_assert (self);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_DEVICE_PREPARE);
+	nm_act_request_ref (req);
 	nm_info ("Activation (%s) Stage 1 of 5 (Device Prepare) scheduled...", nm_device_get_iface (self));
 
 	source = g_idle_source_new ();
@@ -810,6 +814,7 @@
 	nm_device_activate_schedule_stage3_ip_config_start (req);
 
 out:
+	nm_act_request_unref (req);
 	nm_info ("Activation (%s) Stage 2 of 5 (Device Configure) complete.", iface);
 	return FALSE;
 }
@@ -833,6 +838,7 @@
 	g_assert (self);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_DEVICE_CONFIG);
+	nm_act_request_ref (req);
 
 	source = g_idle_source_new ();
 	g_source_set_callback (source, (GSourceFunc) nm_device_activate_stage2_device_config, req, NULL);
@@ -918,6 +924,7 @@
 
 out:
 	nm_info ("Activation (%s) Stage 3 of 5 (IP Configure Start) complete.", iface);
+	nm_act_request_unref (req);
 	return FALSE;
 }
 
@@ -939,6 +946,7 @@
 	g_assert (self);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_IP_CONFIG_START);
+	nm_act_request_ref (req);
 
 	source = g_idle_source_new ();
 	g_source_set_callback (source, (GSourceFunc) nm_device_activate_stage3_ip_config_start, req, NULL);
@@ -1059,9 +1067,11 @@
 		goto out;
 
 	nm_act_request_set_ip4_config (req, ip4_config);
+	nm_ip4_config_unref (ip4_config);
 	nm_device_activate_schedule_stage5_ip_config_commit (req);
 
 out:
+	nm_act_request_unref (req);
 	nm_info ("Activation (%s) Stage 4 of 5 (IP Configure Get) complete.", nm_device_get_iface (self));
 	return FALSE;
 }
@@ -1085,6 +1095,7 @@
 	g_assert (self);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_IP_CONFIG_GET);
+	nm_act_request_ref (req);
 	nm_info ("Activation (%s) Stage 4 of 5 (IP Configure Get) scheduled...",
 			nm_device_get_iface (self));
 
@@ -1154,6 +1165,7 @@
 	g_assert (ip4_config);
 
 	nm_act_request_set_ip4_config (req, ip4_config);
+	nm_ip4_config_unref (ip4_config);
 	nm_device_activate_schedule_stage5_ip_config_commit (req);
 
 out:
@@ -1236,6 +1248,7 @@
 		nm_policy_schedule_activation_failed (req);
 
 out:
+	nm_act_request_unref (req);
 	nm_info ("Activation (%s) Stage 5 of 5 (IP Configure Commit) complete.",
 			nm_device_get_iface (self));
 	return FALSE;
@@ -1259,6 +1272,7 @@
 	g_assert (self);
 
 	nm_act_request_set_stage (req, NM_ACT_STAGE_IP_CONFIG_COMMIT);
+	nm_act_request_ref (req);
 
 	source = g_idle_source_new ();
 	g_source_set_callback (source, (GSourceFunc) nm_device_activate_stage5_ip_config_commit, req, NULL);
--- a/src/nm-netlink-monitor.c
+++ b/src/nm-netlink-monitor.c
@@ -318,6 +318,7 @@
 			       (GDestroyNotify) 
                                nm_netlink_monitor_clear_event_source);
 	g_source_attach (event_source, context);
+	g_source_unref (event_source);
 	monitor->priv->event_source = event_source;
 }
 
--- a/src/backends/NetworkManagerSuSE.c
+++ b/src/backends/NetworkManagerSuSE.c
@@ -659,6 +659,8 @@
 		free (mode);
 		free (buf);
 	}
+	else if (buf)
+		g_free (buf);
 
 	sys_data->config = nm_ip4_config_new ();
 
--- a/src/dhcp-manager/nm-dhcp-manager.c
+++ b/src/dhcp-manager/nm-dhcp-manager.c
@@ -586,6 +586,17 @@
 	nm_ip4_config_set_mtu (ip4_config, nm_system_get_mtu (dev));
 
 out:
+	g_free (hostname);
+	g_free (domain_names);
+	g_free (nis_domain);
+
+	g_free (ip4_address);
+	g_free (ip4_netmask);
+	g_free (ip4_broadcast);
+	g_free (ip4_gateway);
+	g_free (ip4_nameservers);
+	g_free (ip4_nis_servers);
+
 	return ip4_config;
 }
 
--- a/src/vpn-manager/nm-dbus-vpn.c
+++ b/src/vpn-manager/nm-dbus-vpn.c
@@ -347,8 +347,6 @@
 	g_return_if_fail (cb_data->data != NULL);
 	g_return_if_fail (cb_data->data->vpn_manager != NULL);
 
-	dbus_pending_call_ref (pcall);
-
 	if (!dbus_pending_call_get_completed (pcall))
 		goto out;
 
@@ -417,8 +415,6 @@
 
 	g_return_if_fail (pcall);
 	g_return_if_fail (data != NULL);
-
-	dbus_pending_call_ref (pcall);
 
 	if (!dbus_pending_call_get_completed (pcall))
 		goto out;