From b52f89e53b7d92254603202d4585febd5fd3d7ea Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 19 Aug 2026 01:42:41 +0900 Subject: [PATCH] repart: refuse multiple requests with subscribe mode Otherwise, that triggers memory leak and double free. --- src/repart/repart-list-candidate-devices.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/repart/repart-list-candidate-devices.c b/src/repart/repart-list-candidate-devices.c index f4f5a8aa2c..550064cb64 100644 --- a/src/repart/repart-list-candidate-devices.c +++ b/src/repart/repart-list-candidate-devices.c @@ -169,6 +169,10 @@ int vl_method_list_candidate_devices( _cleanup_(list_candidate_devices_context_freep) ListCandidateDevicesContext *c = NULL; if (p.subscribe) { + /* Refuse multiple requests per connection. */ + if (sd_varlink_get_userdata(link)) + return -EBUSY; + /* Start the monitor *before* the initial enumeration so we don't lose events that fire * during the enumeration window. Duplicate add events for the same device are * legitimate and documented; clients upsert by identifier. */