core/dbus-execute: fix memleak on Mount/ExtensionImages parse failure (#40398)

Fixes #40386

src/bless-boot/bless-boot-generator.c

@@ -26,6 +26,11 @@ static int run(const char *dest, const char *dest_early, const char *dest_late)
                 return 0;
         }
 
+        if (generator_soft_rebooted()) {
+                log_debug("Skipping generator, current system is entered via soft-reboot.");
+                return 0;
+        }
+
         if (!is_efi_boot()) {
                 log_debug("Skipping generator, not an EFI boot.");
                 return 0;

src/core/dbus-execute.c

@@ -4047,8 +4047,8 @@ int bus_exec_context_set_transient_property(
                 _cleanup_free_ char *format_str = NULL;
                 MountImage *mount_images = NULL;
                 size_t n_mount_images = 0;
-                char *source, *destination;
-                int permissive;
+
+                CLEANUP_ARRAY(mount_images, n_mount_images, mount_image_free_many);
 
                 r = sd_bus_message_enter_container(message, 'a', "(ssba(ss))");
                 if (r < 0)
@@ -4057,7 +4057,8 @@ int bus_exec_context_set_transient_property(
                 for (;;) {
                         _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
                         _cleanup_free_ char *source_escaped = NULL, *destination_escaped = NULL;
-                        char *tuple;
+                        char *source, *destination;
+                        int permissive;
 
                         r = sd_bus_message_enter_container(message, 'r', "ssba(ss)");
                         if (r < 0)
@@ -4084,15 +4085,12 @@ int bus_exec_context_set_transient_property(
                         if (!destination_escaped)
                                 return -ENOMEM;
 
-                        tuple = strjoin(format_str,
-                                        format_str ? " " : "",
+                        r = strextendf_with_separator(&format_str, " ", "%s%s:%s",
                                                       permissive ? "-" : "",
                                                       source_escaped,
-                                        ":",
                                                       destination_escaped);
-                        if (!tuple)
-                                return -ENOMEM;
-                        free_and_replace(format_str, tuple);
+                        if (r < 0)
+                                return r;
 
                         r = bus_read_mount_options(message, reterr_error, &options, &format_str, ":");
                         if (r < 0)
@@ -4122,12 +4120,18 @@ int bus_exec_context_set_transient_property(
 
                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
                         if (n_mount_images == 0) {
-                                c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
+                                mount_image_free_many(c->mount_images, c->n_mount_images);
+                                c->mount_images = NULL;
+                                c->n_mount_images = 0;
 
                                 unit_write_settingf(u, flags, name, "%s=", name);
                         } else {
-                                for (size_t i = 0; i < n_mount_images; ++i) {
-                                        r = mount_image_add(&c->mount_images, &c->n_mount_images, &mount_images[i]);
+                                if (!c->mount_images) {
+                                        c->mount_images = TAKE_PTR(mount_images);
+                                        c->n_mount_images = n_mount_images;
+                                } else
+                                        FOREACH_ARRAY(i, mount_images, n_mount_images) {
+                                                r = mount_image_add(&c->mount_images, &c->n_mount_images, i);
                                                 if (r < 0)
                                                         return r;
                                         }
@@ -4140,14 +4144,15 @@ int bus_exec_context_set_transient_property(
                         }
                 }
 
-                mount_images = mount_image_free_many(mount_images, &n_mount_images);
-
                 return 1;
+
         } else if (streq(name, "ExtensionImages")) {
                 _cleanup_free_ char *format_str = NULL;
                 MountImage *extension_images = NULL;
                 size_t n_extension_images = 0;
 
+                CLEANUP_ARRAY(extension_images, n_extension_images, mount_image_free_many);
+
                 r = sd_bus_message_enter_container(message, 'a', "(sba(ss))");
                 if (r < 0)
                         return r;
@@ -4155,7 +4160,7 @@ int bus_exec_context_set_transient_property(
                 for (;;) {
                         _cleanup_(mount_options_free_allp) MountOptions *options = NULL;
                         _cleanup_free_ char *source_escaped = NULL;
-                        char *source, *tuple;
+                        char *source;
                         int permissive;
 
                         r = sd_bus_message_enter_container(message, 'r', "sba(ss)");
@@ -4176,13 +4181,10 @@ int bus_exec_context_set_transient_property(
                         if (!source_escaped)
                                 return -ENOMEM;
 
-                        tuple = strjoin(format_str,
-                                        format_str ? " " : "",
-                                        permissive ? "-" : "",
-                                        source_escaped);
-                        if (!tuple)
-                                return -ENOMEM;
-                        free_and_replace(format_str, tuple);
+                        r = strextendf_with_separator(&format_str, " ", "%s%s",
+                                                      permissive ? "-" : "", source_escaped);
+                        if (r < 0)
+                                return r;
 
                         r = bus_read_mount_options(message, reterr_error, &options, &format_str, ":");
                         if (r < 0)
@@ -4211,12 +4213,18 @@ int bus_exec_context_set_transient_property(
 
                 if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
                         if (n_extension_images == 0) {
-                                c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
+                                mount_image_free_many(c->extension_images, c->n_extension_images);
+                                c->extension_images = NULL;
+                                c->n_extension_images = 0;
 
                                 unit_write_settingf(u, flags, name, "%s=", name);
                         } else {
-                                for (size_t i = 0; i < n_extension_images; ++i) {
-                                        r = mount_image_add(&c->extension_images, &c->n_extension_images, &extension_images[i]);
+                                if (!c->extension_images) {
+                                        c->extension_images = TAKE_PTR(extension_images);
+                                        c->n_extension_images = n_extension_images;
+                                } else
+                                        FOREACH_ARRAY(i, extension_images, n_extension_images) {
+                                                r = mount_image_add(&c->extension_images, &c->n_extension_images, i);
                                                 if (r < 0)
                                                         return r;
                                         }
@@ -4229,8 +4237,6 @@ int bus_exec_context_set_transient_property(
                         }
                 }
 
-                extension_images = mount_image_free_many(extension_images, &n_extension_images);
-
                 return 1;
 
         } else if (STR_IN_SET(name, "StateDirectorySymlink", "RuntimeDirectorySymlink", "CacheDirectorySymlink", "LogsDirectorySymlink")) {

src/core/execute.c

@@ -684,8 +684,6 @@ void exec_context_done(ExecContext *c) {
         iovec_done(&c->root_hash_sig);
         c->root_hash_sig_path = mfree(c->root_hash_sig_path);
         c->root_verity = mfree(c->root_verity);
-        c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
-        c->extension_directories = strv_free(c->extension_directories);
         c->tty_path = mfree(c->tty_path);
         c->syslog_identifier = mfree(c->syslog_identifier);
         c->user = mfree(c->user);
@@ -705,10 +703,16 @@ void exec_context_done(ExecContext *c) {
         bind_mount_free_many(c->bind_mounts, c->n_bind_mounts);
         c->bind_mounts = NULL;
         c->n_bind_mounts = 0;
+        mount_image_free_many(c->mount_images, c->n_mount_images);
+        c->mount_images = NULL;
+        c->n_mount_images = 0;
+        mount_image_free_many(c->extension_images, c->n_extension_images);
+        c->extension_images = NULL;
+        c->n_extension_images = 0;
+        c->extension_directories = strv_free(c->extension_directories);
         temporary_filesystem_free_many(c->temporary_filesystems, c->n_temporary_filesystems);
         c->temporary_filesystems = NULL;
         c->n_temporary_filesystems = 0;
-        c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
 
         cpu_set_done(&c->cpu_set);
         numa_policy_reset(&c->numa_policy);

src/core/load-fragment.c

@@ -5175,7 +5175,9 @@ int config_parse_mount_images(
 
         if (isempty(rvalue)) {
                 /* Empty assignment resets the list */
-                c->mount_images = mount_image_free_many(c->mount_images, &c->n_mount_images);
+                mount_image_free_many(c->mount_images, c->n_mount_images);
+                c->mount_images = NULL;
+                c->n_mount_images = 0;
                 return 0;
         }
 
@@ -5323,7 +5325,9 @@ int config_parse_extension_images(
 
         if (isempty(rvalue)) {
                 /* Empty assignment resets the list */
-                c->extension_images = mount_image_free_many(c->extension_images, &c->n_extension_images);
+                mount_image_free_many(c->extension_images, c->n_extension_images);
+                c->extension_images = NULL;
+                c->n_extension_images = 0;
                 return 0;
         }
 

src/core/namespace.c

@@ -3098,19 +3098,16 @@ int bind_mount_add(BindMount **b, size_t *n, const BindMount *item) {
         return 0;
 }
 
-MountImage* mount_image_free_many(MountImage *m, size_t *n) {
-        assert(n);
-        assert(m || *n == 0);
+void mount_image_free_many(MountImage *m, size_t n) {
+        assert(m || n == 0);
 
-        for (size_t i = 0; i < *n; i++) {
-                free(m[i].source);
-                free(m[i].destination);
-                mount_options_free_all(m[i].mount_options);
+        FOREACH_ARRAY(i, m, n) {
+                free(i->source);
+                free(i->destination);
+                mount_options_free_all(i->mount_options);
         }
 
         free(m);
-        *n = 0;
-        return NULL;
 }
 
 int mount_image_add(MountImage **m, size_t *n, const MountImage *item) {

src/core/namespace.h

@@ -286,13 +286,16 @@ DECLARE_STRING_TABLE_LOOKUP(private_pids, PrivatePIDs);
 void bind_mount_free_many(BindMount *b, size_t n);
 int bind_mount_add(BindMount **b, size_t *n, const BindMount *item);
 
-void temporary_filesystem_free_many(TemporaryFileSystem *t, size_t n);
-int temporary_filesystem_add(TemporaryFileSystem **t, size_t *n,
-                             const char *path, const char *options);
-
-MountImage* mount_image_free_many(MountImage *m, size_t *n);
+void mount_image_free_many(MountImage *m, size_t n);
 int mount_image_add(MountImage **m, size_t *n, const MountImage *item);
 
+void temporary_filesystem_free_many(TemporaryFileSystem *t, size_t n);
+int temporary_filesystem_add(
+                TemporaryFileSystem **t,
+                size_t *n,
+                const char *path,
+                const char *options);
+
 int refresh_extensions_in_namespace(
                 const PidRef *target,
                 const char *hierarchy_env,

src/resolve/resolved-manager.c

@@ -2071,6 +2071,12 @@ static int dns_configuration_json_append(
 
         assert(configuration);
 
+        if (current_dns_server) {
+                r = dns_server_dump_configuration_to_json(current_dns_server, &current_dns_server_json);
+                if (r < 0)
+                        return r;
+        }
+
         SET_FOREACH(scope, dns_scopes) {
                 _cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
 

test/units/TEST-75-RESOLVED.sh

@@ -959,6 +959,9 @@ testcase_10_resolvectl_json() {
 
     assert_eq "$(resolvectl --json=short nta dns0 | jq -rc '.[0].negativeTrustAnchors | .[0]')" 'bar'
     assert_eq "$(jq -rc '.[0].negativeTrustAnchors | .[0]' "$status_json")" 'bar'
+
+    # Test that currentServer is non-empty.
+    jq -rce '.[0].currentServer' "$status_json"
 }
 
 # Test serve stale feature and NFTSet= if nftables is installed