machine-register: don't unref borrowed varlink reply

ASAN showed a use-after-free error for systemd-vmspawn's
machine_register call because the reply got accessed and freed again
through _cleanup. The same problem exists in two
verb_machine_control_one/unregister_machine.
Fix these call sites to not set up _cleanup.

diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index e8a30a89592a37c709d1bba6226eb98052d79ca7..ae5473aa99d508d5bea63fa5d1ae1a8f238b443a 100644 (file)
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -1242,7 +1242,7 @@ static int verb_machine_control_one(const char *machine_name, const char *method
         if (r < 0)
                 return log_error_errno(r, "Failed to connect to machine control socket: %m");
 
-        _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+        sd_json_variant *reply = NULL;
         const char *error_id = NULL;
         r = sd_varlink_call(vl, method, /* parameters= */ NULL, &reply, &error_id);
         if (r < 0)

diff --git a/src/shared/machine-register.c b/src/shared/machine-register.c
index a161d1b0508d399f16079534b9e6992e62b814b2..9637793fe549fd29dfe5e1695fad55df6394508c 100644 (file)
--- a/src/shared/machine-register.c
+++ b/src/shared/machine-register.c
@@ -170,8 +170,7 @@ int register_machine(
         }
         if (r < 0)
                 return log_debug_errno(r, "Failed to connect to machined on %s: %m", strna(p));
-
-        _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+        sd_json_variant *reply = NULL;
         const char *error_id = NULL;
         r = sd_varlink_callbo(
                         vl,
@@ -306,7 +305,7 @@ int unregister_machine(sd_bus *bus, const char *machine_name, RuntimeScope scope
         if (r >= 0)
                 r = sd_varlink_connect_address(&vl, p);
         if (r >= 0) {
-                _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+                sd_json_variant *reply = NULL;
                 const char *error_id = NULL;
                 r = sd_varlink_callbo(
                                 vl,