Merge ~enr0n/ubuntu/+source/systemd:ubuntu-focal into ~ubuntu-core-dev/ubuntu/+source/systemd:ubuntu-focal

[Nick Rosbrook]

Quick follow on to the current upload in -propsed as per customer request.

This has built in my PPA: https://launchpad.net/~enr0n/+archive/ubuntu/systemd-245/+packages.

I will post the autopkgtest results when they have finished.

[Lukas Märdian (slyon)]

Thanks, LGTM. Patch matches upstream fix and is included in Jammy (249.11) and above.

I'm fine sponsoring this as soon as we have the tests results.
Do you want it to be sponsored together with the currently pending Focal SRU in focal-proposed or uploaded separately afterward?

review: Approve

[Nick Rosbrook (enr0n)]

autopkgtest results:

systemd 245.4-4ubuntu3.22~ppa1 (amd64) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-enr0n-systemd-245/focal/amd64/s/systemd/20230327_222555_b66c3@/log.gz
systemd 245.4-4ubuntu3.22~ppa1 (arm64) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-enr0n-systemd-245/focal/arm64/s/systemd/20230327_231356_3bf23@/log.gz
systemd 245.4-4ubuntu3.22~ppa1 (armhf) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-enr0n-systemd-245/focal/armhf/s/systemd/20230327_185052_a104f@/log.gz
systemd 245.4-4ubuntu3.22~ppa1 (ppc64el) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-enr0n-systemd-245/focal/ppc64el/s/systemd/20230327_200800_38040@/log.gz
systemd 245.4-4ubuntu3.22~ppa1 (s390x) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-focal-enr0n-systemd-245/focal/s390x/s/systemd/20230327_224230_da29b@/log.gz

The two failures are test bed failures.

I was thinking it would make the most sense to upload now since SRU verification did not happen yet for the other bugs, and this is an urgent fix from the customer perspective.

diff --git a/debian/changelog b/debian/changelog
index 9185ef8..e8e0e5b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+systemd (245.4-4ubuntu3.22) focal; urgency=medium
+
+  * resolve: fix potential memleak and use-after-free (LP: #2012943)
+    File: debian/patches/lp2012943-resolve-fix-potential-memleak-and-use-after-free.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=ed2729587663dbab3583d06492b715df2896874e
+
+ -- Nick Rosbrook <[e-mail]>  Mon, 27 Mar 2023 13:54:06 -0400
+
 systemd (245.4-4ubuntu3.21) focal; urgency=medium
 
   * udev: avoid NIC renaming race with kernel (LP: #2002445)
diff --git a/debian/patches/lp2012943-resolve-fix-potential-memleak-and-use-after-free.patch b/debian/patches/lp2012943-resolve-fix-potential-memleak-and-use-after-free.patch
new file mode 100644
index 0000000..532a601
--- /dev/null
+++ b/debian/patches/lp2012943-resolve-fix-potential-memleak-and-use-after-free.patch
@@ -0,0 +1,33 @@
+From: Yu Watanabe <[e-mail]>
+Date: Sat, 5 Feb 2022 21:37:01 +0900
+Subject: resolve: fix potential memleak and use-after-free
+
+Origin: upstream, https://github.com/systemd/systemd/commit/73bfd7be042cc63e7649242b377ad494bf74ea4b
+Bug-Ubuntu: https://launchpad.net/bugs/2012943
+
+When stub stream is closed early, then queries associated to the stream
+are freed. Previously, the timer event source for queries may not be
+disabled, hence may be triggered with already freed query.
+See also dns_stub_stream_complete().
+
+Note that we usually not set NULL or zero when freeing simple objects.
+But, here DnsQuery is large and complicated object, and the element may
+be referenced in subsequent freeing process in the future. Hence, for
+safety, let's set NULL to the pointer.
+---
+ src/resolve/resolved-dns-query.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/resolve/resolved-dns-query.c b/src/resolve/resolved-dns-query.c
+index 614cc32..564bc3c 100644
+--- a/src/resolve/resolved-dns-query.c
++++ b/src/resolve/resolved-dns-query.c
+@@ -363,6 +363,8 @@ DnsQuery *dns_query_free(DnsQuery *q) {
+         if (!q)
+                 return NULL;
+ 
++        q->timeout_event_source = sd_event_source_disable_unref(q->timeout_event_source);
++
+         while (q->auxiliary_queries)
+                 dns_query_free(q->auxiliary_queries);
+ 
diff --git a/debian/patches/series b/debian/patches/series
index 49f6f2e..9fa4a07 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -193,3 +193,4 @@ lp2002445-netlink-do-not-fail-when-new-interface-name-is-already-us.patch
 lp2002445-sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
 lp2002445-udev-attempt-device-rename-even-if-interface-is-up.patch
 lp1933090-test-seccomp-accept-ENOSYS-from-sysctl-2-too.patch
+lp2012943-resolve-fix-potential-memleak-and-use-after-free.patch