From: David Tardon <dtardon@redhat.com>
Date: Fri, 5 Dec 2025 14:17:13 +0000 (+0100)
Subject: udev-rules: use the right variable
X-Git-Tag: v259-rc3~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d23a7eb4c0b9f72d90f367de6fdc85b759aa6859;p=thirdparty%2Fsystemd.git

udev-rules: use the right variable

We carefully prepare a copy of a local buffer to save in device cache
and then save the buffer there instead... This leads to abort in free()
on exit (also, copied is leaked).

Reproducer:
 # udevadm test /sys/block/sr0

Follow-up-for: a9559ebcbcf3098b2c14e5e10e99d05aaffe4ac3

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2406118
---

diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
index 76369f69068..aea7ac6e20d 100644
--- a/src/udev/udev-rules.c
+++ b/src/udev/udev-rules.c
@@ -3026,7 +3026,7 @@ static int udev_rule_apply_token_to_event(
                                 if (!copied)
                                         return log_oom();
 
-                                r = device_cache_sysattr_value(dev, resolved, value, /* error = */ 0);
+                                r = device_cache_sysattr_value(dev, resolved, copied, /* error = */ 0);
                                 if (r < 0)
                                         log_event_warning_errno(event, token, r, "Failed to cache sysfs attribute \"%s\", ignoring: %m", resolved);
                                 else if (r > 0) {