From 92e0c920c7e4ad99a9a0b388038e38588e251559 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:28:08 +0200 Subject: [PATCH 1/7] basic/path-util: fix executable_is_good MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by qarmin (Rafał Mikrut). --- src/basic/path-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/basic/path-util.c b/src/basic/path-util.c index fedb347e4a..b41029b157 100644 --- a/src/basic/path-util.c +++ b/src/basic/path-util.c @@ -804,7 +804,7 @@ static int executable_is_good(const char *executable) { if (r < 0) return r; - return !PATH_IN_SET(d, "true" + return !PATH_IN_SET(d, "true", "/bin/true", "/usr/bin/true", "/dev/null"); From e305f552ec34be6df08abb1882707091b2b61479 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:29:12 +0200 Subject: [PATCH 2/7] core/dbus-execute: propagate oom in property_get_cpu_affinity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The function already returns errors, so I'm not sure why we ignored the error in the second call, potentially leaving variables unitialized. It seems easiest to propagate the error. Reported by qarmin (Rafał Mikrut). --- src/core/dbus-execute.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c index 906002570f..4d86c07a41 100644 --- a/src/core/dbus-execute.c +++ b/src/core/dbus-execute.c @@ -123,19 +123,20 @@ static int property_get_cpu_affinity( _cleanup_(cpu_set_done) CPUSet s = {}; _cleanup_free_ uint8_t *array = NULL; size_t allocated; + int r; assert(bus); assert(reply); if (c->cpu_affinity_from_numa) { - int r; - r = numa_to_cpu_set(&c->numa_policy, &s); if (r < 0) return r; } - (void) cpu_set_to_dbus(c->cpu_affinity_from_numa ? &s : &c->cpu_set, &array, &allocated); + r = cpu_set_to_dbus(c->cpu_affinity_from_numa ? &s : &c->cpu_set, &array, &allocated); + if (r < 0) + return r; return sd_bus_message_append_array(reply, 'y', array, allocated); } From fd12cc9a52ea950afaf5cb0da85d4bb195a60683 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:30:36 +0200 Subject: [PATCH 3/7] core/manager: fix (theoretical) fd leak on invalid messages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We'd leak fds on early return. We are sending a message to ourself, so it's unlikely to fail. But let's keep the logic correct. Reported by qarmin (Rafał Mikrut). --- src/core/manager.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/core/manager.c b/src/core/manager.c index accf9c8ff9..165914b2a5 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -5119,6 +5119,7 @@ static int manager_dispatch_pidref_transport_fd(sd_event_source *source, int fd, if (n != sizeof(child_pid)) { log_warning("Got pidref message of unexpected size %zi (expected %zu), ignoring.", n, sizeof(child_pid)); + cmsg_close_all(&msghdr); return 0; } @@ -5138,6 +5139,8 @@ static int manager_dispatch_pidref_transport_fd(sd_event_source *source, int fd, } } + /* From this point on, the fds are owned by our local variables. Call cmsg_close_all no more. */ + /* Verify and set parent pidref. */ if (!ucred || !pid_is_valid(ucred->pid)) { log_warning("Received pidref message without valid credentials. Ignoring."); From 4f688e61c95dc6848a624864c295c62b8c2ab3d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:31:46 +0200 Subject: [PATCH 4/7] coredump: use a fixed string instead a scope-delimited compound literal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The compound literal (const char[]){'.','.','.'} has block scope (C99 6.5.2.5p6). Once we leave the if and loop back, copy[1].iov_base formally points into a destroyed object. Works on GCC/Clang in practice, but is UB. Let's do the easy thing and use a string. Reported by qarmin (Rafał Mikrut). --- src/coredump/coredump-send.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/coredump/coredump-send.c b/src/coredump/coredump-send.c index 0174be69a4..4817d82611 100644 --- a/src/coredump/coredump-send.c +++ b/src/coredump/coredump-send.c @@ -57,7 +57,7 @@ int coredump_send(CoredumpContext *context) { * what we want to send, and the second one contains * the trailing dots. */ copy[0] = *iovec; - copy[1] = IOVEC_MAKE(((const char[]){'.', '.', '.'}), 3); + copy[1] = IOVEC_MAKE_STRING("..."); mh.msg_iov = copy; mh.msg_iovlen = 2; From f0405bfdff0ca3787d2d83a30c3fffc65ff00f00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:31:55 +0200 Subject: [PATCH 5/7] nsresourced: fix typo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by qarmin (Rafał Mikrut). --- src/nsresourced/userns-restrict.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nsresourced/userns-restrict.c b/src/nsresourced/userns-restrict.c index 11bb2e7d8f..a6cdd03c5e 100644 --- a/src/nsresourced/userns-restrict.c +++ b/src/nsresourced/userns-restrict.c @@ -244,7 +244,7 @@ int userns_restrict_put_by_inode( if (n_try == 0) return log_debug_errno(SYNTHETIC_ERRNO(EEXIST), - "Stillcan't create inode entry in BPF map after 10 tries."); + "Still cannot create inode entry in BPF map after 10 tries."); r = sym_bpf_map_lookup_elem(outer_map_fd, &ino, &innermap_id); if (r >= 0) { From 3a333585fe3c825430910bd5953e6b3956bb9944 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:33:08 +0200 Subject: [PATCH 6/7] repart: fix bogus errno in error message and returned value MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by qarmin (Rafał Mikrut). --- src/repart/repart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/repart/repart.c b/src/repart/repart.c index dca90f2509..133a8e0211 100644 --- a/src/repart/repart.c +++ b/src/repart/repart.c @@ -3442,8 +3442,8 @@ static int context_copy_from_one(Context *context, const char *src) { if (!np->copy_blocks_path) return log_oom(); - np->copy_blocks_fd = fcntl(fd, F_DUPFD_CLOEXEC, 3); - if (np->copy_blocks_fd < 0) + np->copy_blocks_fd = r = RET_NERRNO(fcntl(fd, F_DUPFD_CLOEXEC, 3)); + if (r < 0) return log_error_errno(r, "Failed to duplicate file descriptor of %s: %m", src); np->copy_blocks_offset = start; From 901179e3c74209fcdd4d27523c8705d14517e85f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 18 May 2026 12:33:24 +0200 Subject: [PATCH 7/7] sysupdate: fix noop assert MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by qarmin (Rafał Mikrut). --- src/sysupdate/sysupdate-pattern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/sysupdate/sysupdate-pattern.c b/src/sysupdate/sysupdate-pattern.c index 58aa524a5d..e1cc3dc466 100644 --- a/src/sysupdate/sysupdate-pattern.c +++ b/src/sysupdate/sysupdate-pattern.c @@ -420,7 +420,7 @@ int pattern_match(const char *pattern, const char *s, InstanceMetadata *ret) { } default: - assert_se("unexpected pattern element"); + assert_not_reached(); } p = n;