From 76a6dc6dc01831b7d641c3b21a1ca2f8eec29e5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kai=20L=C3=BCke?= Date: Tue, 11 Aug 2026 01:18:29 +0900 Subject: [PATCH] pcrextend: Fix use-after-free/double-free error in pcrextend_pcr_now With SignInitrdPCRs=disabled in mkosi the TPM/PCR services are broken which triggers the error path in the varlink call which means that we get parameters set in the response. The wrong ownership assumption when looking at the reply with _cleanup_ set caused a memory corruption that surfaced in systemd-sysext with an ABRT. This is a common mistake done with the API, fix it by not setting _cleanup_(sd_json_variant_unrefp). --- src/shared/pcrextend-util.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/shared/pcrextend-util.c b/src/shared/pcrextend-util.c index 158699a73d..afa1b88cf5 100644 --- a/src/shared/pcrextend-util.c +++ b/src/shared/pcrextend-util.c @@ -58,7 +58,8 @@ int pcrextend_pcr_now(unsigned pcr, const char *word, const struct iovec *secret if (iovec_is_set(secret)) sd_json_variant_sensitive(parameters); - _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL; + /* Both the reply and the error id are borrowed from the connection, don't unref/free them. */ + sd_json_variant *reply = NULL; const char *error_id = NULL; r = sd_varlink_call(vl, "io.systemd.PCRExtend.Extend", parameters, &reply, &error_id); if (r < 0) @@ -91,7 +92,8 @@ int pcrextend_nvpcr_now(const char *nvpcr, const char *word, const char *event) if (r < 0) return r; - _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL; + /* Both the reply and the error id are borrowed from the connection, don't unref/free them. */ + sd_json_variant *reply = NULL; const char *error_id = NULL; r = sd_varlink_callbo( vl,