Four *_attach_event helpers swallow sd_event_default() failures and
return success while leaving obj->event NULL:
sd_dhcp_client_attach_event (sd-dhcp-client.c)
sd_dhcp6_client_attach_event (sd-dhcp6-client.c)
sd_ndisc_attach_event (sd-ndisc.c)
sd_radv_attach_event (sd-radv.c)
Each contains the same copy-pasted typo in the NULL-event branch:
r = sd_event_default(&obj->event);
if (r < 0)
return 0; /* swallows -ENOMEM / -ECHILD */
The caller is told the attach succeeded, but obj->event is still
NULL. A subsequent *_start() then trips assert_return(obj->event,
-EINVAL) and returns a spurious -EINVAL (or aborts on assert-abort
builds), and any consumer of *_get_event() dereferences NULL.
The sibling helper sd_dhcp_server_attach_event already uses the
correct pattern:
r = sd_event_default(&server->event);
if (r < 0)
return r;
Fix by returning r instead of 0 at each of the four sites so the
sd_event_default() errno is propagated to the caller and ownership
stays with the caller.
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
else {
r = sd_event_default(&client->event);
if (r < 0)
- return 0;
+ return r;
}
client->event_priority = priority;
else {
r = sd_event_default(&client->event);
if (r < 0)
- return 0;
+ return r;
}
client->event_priority = priority;
else {
r = sd_event_default(&nd->event);
if (r < 0)
- return 0;
+ return r;
}
nd->event_priority = priority;
else {
r = sd_event_default(&ra->event);
if (r < 0)
- return 0;
+ return r;
}
ra->event_priority = priority;