From 60e50fb20d20acf59cf98e4cc2388aa9aed61014 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 17 Apr 2022 13:38:39 +0900 Subject: [PATCH] sd-device: reset sysname and sysnum on renaming --- src/libsystemd/sd-device/device-private.c | 4 ++++ src/udev/udev-event.c | 10 ++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/src/libsystemd/sd-device/device-private.c b/src/libsystemd/sd-device/device-private.c index 9bf39ecfab2..b6043848eae 100644 --- a/src/libsystemd/sd-device/device-private.c +++ b/src/libsystemd/sd-device/device-private.c @@ -773,6 +773,10 @@ int device_rename(sd_device *device, const char *name) { if (r < 0) return r; + /* Here, only clear the sysname and sysnum. They will be set when requested. */ + device->sysnum = NULL; + device->sysname = mfree(device->sysname); + r = sd_device_get_property_value(device, "INTERFACE", &interface); if (r == -ENOENT) return 0; diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c index 78e8f3018c5..9b531051999 100644 --- a/src/udev/udev-event.c +++ b/src/udev/udev-event.c @@ -869,15 +869,21 @@ int udev_event_spawn( } static int rename_netif(UdevEvent *event) { - sd_device *dev = event->dev; const char *oldname; + sd_device *dev; unsigned flags; int ifindex, r; + assert(event); + if (!event->name) return 0; /* No new name is requested. */ - r = sd_device_get_sysname(dev, &oldname); + dev = ASSERT_PTR(event->dev); + + /* Read sysname from cloned sd-device object, otherwise use-after-free is triggered, as the + * main object will be renamed and dev->sysname will be freed in device_rename(). */ + r = sd_device_get_sysname(event->dev_db_clone, &oldname); if (r < 0) return log_device_error_errno(dev, r, "Failed to get sysname: %m");