From: Luca Boccassi Date: Thu, 2 Jul 2026 21:20:31 +0000 (+0100) Subject: resolve: anchor the service browser from mDNS maintenance queries X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F42865%2Fhead;p=thirdparty%2Fsystemd.git resolve: anchor the service browser from mDNS maintenance queries mdns_maintenance_query() takes a ref on the browser's varlink link but never installs itself as that link's userdata. dns_query_free() then unconditionally runs sd_varlink_set_userdata(varlink_request, NULL), so freeing any maintenance query wipes the browse query's registration on the shared sb->link slot, disabling the abort paths in vl_on_disconnect() and dns_service_browser_free(). The maintenance query also never takes a reference on the DnsServiceBrowser, so a client disconnect could free the browser while a maintenance query was still in flight, leaving the per-service schedule_event timer and the raw service->service_browser back-pointer dangling (use-after-free on the next timer tick or query completion). Take a service_browser_request reference instead, matching the browse query path. dns_query_free() already drops it. The browser now outlives its in-flight maintenance queries. Follow-up for 8458b7fb91ea5e5109b6f3c94f8a781a120c798b --- diff --git a/src/resolve/resolved-dns-browse-services.c b/src/resolve/resolved-dns-browse-services.c index 68dcbee349b..6a48089a594 100644 --- a/src/resolve/resolved-dns-browse-services.c +++ b/src/resolve/resolved-dns-browse-services.c @@ -126,7 +126,7 @@ static int mdns_maintenance_query(sd_event_source *s, uint64_t usec, void *userd return log_error_errno(r, "Failed to create mDNS query for maintenance: %m"); q->complete = mdns_maintenance_query_complete; - q->varlink_request = sd_varlink_ref(service->service_browser->link); + q->service_browser_request = dns_service_browser_ref(service->service_browser); q->dnsservice_request = dnssd_discovered_service_ref(service); /* Schedule the next maintenance query based on the TTL */