machine-register: don't unref borrowed varlink reply
ASAN showed a use-after-free error for systemd-vmspawn's machine_register call because the reply got accessed and freed again through _cleanup. The same problem exists in two verb_machine_control_one/unregister_machine. Fix these call sites to not set up _cleanup.
This commit is contained in:
@@ -1242,7 +1242,7 @@ static int verb_machine_control_one(const char *machine_name, const char *method
|
||||
if (r < 0)
|
||||
return log_error_errno(r, "Failed to connect to machine control socket: %m");
|
||||
|
||||
_cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
|
||||
sd_json_variant *reply = NULL;
|
||||
const char *error_id = NULL;
|
||||
r = sd_varlink_call(vl, method, /* parameters= */ NULL, &reply, &error_id);
|
||||
if (r < 0)
|
||||
|
||||
@@ -170,8 +170,7 @@ int register_machine(
|
||||
}
|
||||
if (r < 0)
|
||||
return log_debug_errno(r, "Failed to connect to machined on %s: %m", strna(p));
|
||||
|
||||
_cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
|
||||
sd_json_variant *reply = NULL;
|
||||
const char *error_id = NULL;
|
||||
r = sd_varlink_callbo(
|
||||
vl,
|
||||
@@ -306,7 +305,7 @@ int unregister_machine(sd_bus *bus, const char *machine_name, RuntimeScope scope
|
||||
if (r >= 0)
|
||||
r = sd_varlink_connect_address(&vl, p);
|
||||
if (r >= 0) {
|
||||
_cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
|
||||
sd_json_variant *reply = NULL;
|
||||
const char *error_id = NULL;
|
||||
r = sd_varlink_callbo(
|
||||
vl,
|
||||
|
||||
Reference in New Issue
Block a user