udev-rules: use the right variable

We carefully prepare a copy of a local buffer to save in device cache
and then save the buffer there instead... This leads to abort in free()
on exit (also, copied is leaked).

Reproducer:
 # udevadm test /sys/block/sr0

Follow-up-for: a9559ebcbcf3098b2c14e5e10e99d05aaffe4ac3

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2406118

diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
index 76369f69068b3f48cdfb702566ad8cc0eef5aa13..aea7ac6e20d95306cad43982cd6399ee8f8efbd2 100644 (file)
--- a/src/udev/udev-rules.c
+++ b/src/udev/udev-rules.c
@@ -3026,7 +3026,7 @@ static int udev_rule_apply_token_to_event(
                                 if (!copied)
                                         return log_oom();
 
-                                r = device_cache_sysattr_value(dev, resolved, value, /* error = */ 0);
+                                r = device_cache_sysattr_value(dev, resolved, copied, /* error = */ 0);
                                 if (r < 0)
                                         log_event_warning_errno(event, token, r, "Failed to cache sysfs attribute \"%s\", ignoring: %m", resolved);
                                 else if (r > 0) {