sd-device: reset sysname and sysnum on renaming

diff --git a/src/libsystemd/sd-device/device-private.c b/src/libsystemd/sd-device/device-private.c
index 9bf39ecfab259833ff355c67f3193a6ba623982b..b6043848eaeba9aab55864c3055da7ed1f35acee 100644 (file)
--- a/src/libsystemd/sd-device/device-private.c
+++ b/src/libsystemd/sd-device/device-private.c
@@ -773,6 +773,10 @@ int device_rename(sd_device *device, const char *name) {
         if (r < 0)
                 return r;
 
+        /* Here, only clear the sysname and sysnum. They will be set when requested. */
+        device->sysnum = NULL;
+        device->sysname = mfree(device->sysname);
+
         r = sd_device_get_property_value(device, "INTERFACE", &interface);
         if (r == -ENOENT)
                 return 0;

diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
index 78e8f3018c59558002018fb8813731600c7bbf90..9b531051999217e339681de4702bdb32b4bc6b08 100644 (file)
--- a/src/udev/udev-event.c
+++ b/src/udev/udev-event.c
@@ -869,15 +869,21 @@ int udev_event_spawn(
 }
 
 static int rename_netif(UdevEvent *event) {
-        sd_device *dev = event->dev;
         const char *oldname;
+        sd_device *dev;
         unsigned flags;
         int ifindex, r;
 
+        assert(event);
+
         if (!event->name)
                 return 0; /* No new name is requested. */
 
-        r = sd_device_get_sysname(dev, &oldname);
+        dev = ASSERT_PTR(event->dev);
+
+        /* Read sysname from cloned sd-device object, otherwise use-after-free is triggered, as the
+         * main object will be renamed and dev->sysname will be freed in device_rename(). */
+        r = sd_device_get_sysname(event->dev_db_clone, &oldname);
         if (r < 0)
                 return log_device_error_errno(dev, r, "Failed to get sysname: %m");