machine-register: don't unref borrowed varlink reply

ASAN showed a use-after-free error for systemd-vmspawn's
machine_register call because the reply got accessed and freed again
through _cleanup. The same problem exists in two
verb_machine_control_one/unregister_machine.
Fix these call sites to not set up _cleanup.
This commit is contained in:
Kai Lüke
2026-04-27 22:14:05 +09:00
parent 41cf689121
commit 70d75c22d7
2 changed files with 3 additions and 4 deletions
+1 -1
View File
@@ -1242,7 +1242,7 @@ static int verb_machine_control_one(const char *machine_name, const char *method
if (r < 0)
return log_error_errno(r, "Failed to connect to machine control socket: %m");
_cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
sd_json_variant *reply = NULL;
const char *error_id = NULL;
r = sd_varlink_call(vl, method, /* parameters= */ NULL, &reply, &error_id);
if (r < 0)
+2 -3
View File
@@ -170,8 +170,7 @@ int register_machine(
}
if (r < 0)
return log_debug_errno(r, "Failed to connect to machined on %s: %m", strna(p));
_cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
sd_json_variant *reply = NULL;
const char *error_id = NULL;
r = sd_varlink_callbo(
vl,
@@ -306,7 +305,7 @@ int unregister_machine(sd_bus *bus, const char *machine_name, RuntimeScope scope
if (r >= 0)
r = sd_varlink_connect_address(&vl, p);
if (r >= 0) {
_cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
sd_json_variant *reply = NULL;
const char *error_id = NULL;
r = sd_varlink_callbo(
vl,