From a77d9ebc580ac1e384bad5316c0920c2fcecbafb Mon Sep 17 00:00:00 2001 From: venkatchalla06 Date: Sat, 10 Oct 2026 23:18:20 +0530 Subject: [PATCH] firstboot: fix use-after-free/double-free of the Varlink reply in process_hostname() ret_parameters (and ret_error_id) returned by sd_varlink_call()/ sd_varlink_callbo() are borrowed from the connection, as documented in sd-varlink.h, and must not be unreffed by the caller. process_hostname() declared its reply as _cleanup_(sd_json_variant_unrefp), freeing memory owned by the Varlink connection and leading to a use-after-free/ double-free (the same bug class and ownership mistake just fixed for pcrextend_pcr_now()/pcrextend_nvpcr_now() in 76a6dc6d). (cherry picked from commit c556722826c4892939d2a6239ab00d0a343530a8) --- src/firstboot/firstboot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c index 34784999bd..3941618db9 100644 --- a/src/firstboot/firstboot.c +++ b/src/firstboot/firstboot.c @@ -794,7 +794,7 @@ static int process_hostname(int rfd, sd_varlink **mute_console_link) { } if (vl) { - _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL; + sd_json_variant *reply = NULL; const char *error_id = NULL; r = sd_varlink_callbo( vl,