]> git.ipfire.org Git - thirdparty/systemd.git/commit
sd-varlink: fix a potential connection count leak
authorFrantisek Sumsal <frantisek@sumsal.cz>
Thu, 9 Apr 2026 13:12:48 +0000 (15:12 +0200)
committerLuca Boccassi <luca.boccassi@gmail.com>
Thu, 9 Apr 2026 21:05:25 +0000 (22:05 +0100)
commitd3a1710bc22b9047620d1a05f76dee8590255206
treeab4d21f7affb6e8b8dbf4de51e5d49fd120de4da
parent4b32ab5a36aea7752be26c18dabc3a554189b19d
sd-varlink: fix a potential connection count leak

With the old version there was a potential connection count leak if
either of the two hashmap operations in count_connection() failed. In
that case we'd return from sd_varlink_server_add_connection_pair()
_before_ attached the sd_varlink_server object to an sd_varlink object,
and since varlink_detach_server() is the only place where the connection
counter is decremented (called through sd_varlink_close() in various
error paths later _if_ the "server" object is not null, i.e. attached to
the sd_varlink object) we'd "leak" a connection every time this
happened. However, the potential of abusing this is very theoretical,
as one would need to hit OOM every time either of the hashmap operations
was executed for a while before exhausting the connection limit.

Let's just increment the connection counter after any potential error
path, so we don't have to deal with potential rollbacks.
src/libsystemd/sd-varlink/sd-varlink.c