From: Christian Brauner <christian@amutable.com>
Date: Wed, 29 Apr 2026 16:28:16 +0000 (+0200)
Subject: blockdev-list: fix per-element leak in block_device_array_free() (#41869)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=994f016a7fb621d782500f54cd3b3b2a06d0d9a4;p=thirdparty%2Fsystemd.git

blockdev-list: fix per-element leak in block_device_array_free() (#41869)

FOREACH_ARRAY declares 'i' as the iterator but the body passed 'd' (the
array base) to block_device_done(). Since mfree() leaves the field NULL
after the first call, element 0 is freed repeatedly while elements
1..N-1 leak their node, symlinks strv, model, vendor and subsystem.

The bug predates the sanitizer-instrumented callers. PR #41776's new
systemd-storage-block daemon runs blockdev_list() under ASan/LSan in
TEST-87-AUX-UTILS-VM and exposes it (15 allocs / 804 bytes leaked per
ListVolumes request). The fix also benefits repart and blockdev_list's
internal CLEANUP_ARRAY cleanup.

Follow-up for 9f6b2745eaa15be80568fde2a44d0a10ed6eb2a1
---

diff --git a/src/shared/blockdev-list.c b/src/shared/blockdev-list.c
index 5b11c816947..0efc90fd546 100644
--- a/src/shared/blockdev-list.c
+++ b/src/shared/blockdev-list.c
@@ -27,7 +27,7 @@ void block_device_done(BlockDevice *d) {
 void block_device_array_free(BlockDevice *d, size_t n_devices) {
 
         FOREACH_ARRAY(i, d, n_devices)
-                block_device_done(d);
+                block_device_done(i);
 
         free(d);
 }