core/unit: fix use-after-free

Fixes #23312.

diff --git a/src/core/unit.c b/src/core/unit.c
index 42ee8892a4f45a040c61af30085f4bea82e9356b..fcfc9bc8d2bea9809d04e065e38645670b6b2e27 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -684,8 +684,8 @@ Unit* unit_free(Unit *u) {
 
         unit_dequeue_rewatch_pids(u);
 
-        sd_bus_slot_unref(u->match_bus_slot);
-        sd_bus_track_unref(u->bus_track);
+        u->match_bus_slot = sd_bus_slot_unref(u->match_bus_slot);
+        u->bus_track = sd_bus_track_unref(u->bus_track);
         u->deserialized_refs = strv_free(u->deserialized_refs);
         u->pending_freezer_message = sd_bus_message_unref(u->pending_freezer_message);