From: Lennart Poettering <lennart@amutable.com>
Date: Mon, 23 Feb 2026 12:25:17 +0000 (+0100)
Subject: sd-netlink: pin reply slot while we execute callback
X-Git-Tag: v257.11~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8fb757c31dc0b018877eabd2366756aab9b0833e;p=thirdparty%2Fsystemd.git

sd-netlink: pin reply slot while we execute callback

The callback might drop the last ref to the slot object, and we still
want to access it. Hence do what we usually do in these cases: keep an
extra reference while processing the callback.

(cherry picked from commit 332ecf40f24b291178ad370a448b6a5227700ae2)
(cherry picked from commit 597b269c08969c2b638be8eaec92d77faa92de19)
(cherry picked from commit ddc2030e3c9b9dc1013bcf1a84d1025fec97f076)
---

diff --git a/src/libsystemd/sd-netlink/sd-netlink.c b/src/libsystemd/sd-netlink/sd-netlink.c
index e6bd69f2de4..6171ae26f1f 100644
--- a/src/libsystemd/sd-netlink/sd-netlink.c
+++ b/src/libsystemd/sd-netlink/sd-netlink.c
@@ -234,7 +234,6 @@ static int process_timeout(sd_netlink *nl) {
 
 static int process_reply(sd_netlink *nl, sd_netlink_message *m) {
         struct reply_callback *c;
-        sd_netlink_slot *slot;
         uint32_t serial;
         uint16_t type;
         int r;
@@ -257,7 +256,8 @@ static int process_reply(sd_netlink *nl, sd_netlink_message *m) {
         if (type == NLMSG_DONE)
                 m = NULL;
 
-        slot = container_of(c, sd_netlink_slot, reply_callback);
+        _cleanup_(sd_netlink_slot_unrefp) sd_netlink_slot *slot =
+                sd_netlink_slot_ref(container_of(c, sd_netlink_slot, reply_callback));
 
         r = c->callback(nl, m, slot->userdata);
         if (r < 0)