From 8f4d5828aa16756ea5653a8dec46043710c3587c Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 12 Dec 2022 14:16:09 +0900 Subject: [PATCH] sd-device: fix double-free If an attribute is read but the value is not used (i.e. ret_value is NULL), then sd_device_get_sysattr_value() mistakenly frees the read data even though it is cached internally. Fixes a bug introduced by acfc2a1d15560084e077ffb3be472cd117e9020a. Fixes #25702. (cherry picked from commit eb18e7b7825e8320bb4d6269690ef8c3f5461d2b) (cherry picked from commit aeb36537443272f0bf73dd672837eabcecb34f3a) Conflict:NA Reference:https://github.com/systemd/systemd-stable/commit/8f4d5828aa16756ea5653a8dec46043710c3587c --- src/libsystemd/sd-device/sd-device.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libsystemd/sd-device/sd-device.c b/src/libsystemd/sd-device/sd-device.c index 5660538dd3..b0f6318fd8 100644 --- a/src/libsystemd/sd-device/sd-device.c +++ b/src/libsystemd/sd-device/sd-device.c @@ -2166,9 +2166,14 @@ _public_ int sd_device_get_sysattr_value(sd_device *device, const char *sysattr, sysattr, value, ret_value ? "" : ", ignoring"); if (ret_value) return r; - } else if (ret_value) - *ret_value = TAKE_PTR(value); + return 0; + } + + if (ret_value) + *ret_value = value; + + TAKE_PTR(value); return 0; } -- 2.33.0