Re: [yocto-patches] [pseudo] [PATCH 0/3] closefrom/close_range: protect every pseudo fd, then drop one

On Wed, 2026-07-29 at 07:19 +0100, Richard Purdie via
lists.yoctoproject.org wrote:
> On Wed, 2026-07-29 at 05:08 +0000, Babanpreet Singh wrote:
> > On Tue, 2026-07-28 at 16:59 +0100, Richard Purdie wrote:
> > > I think the missing piece is this:
> > >=20
> > > - if (op !=3D OP_CHROOT && op !=3D OP_CHDIR && op !=3D OP_CLOSE && op
> > > !=3D OP_CLOSEFROM && op !=3D OP_DUP
> > > + if (op !=3D OP_CHROOT && op !=3D OP_CHDIR && op !=3D OP_CLOSE && op
> > > !=3D OP_CLOSEFROM && op !=3D OP_CLOSE_RANGE && op !=3D OP_DUP
> >=20
> > Sorry for the breakage, and thanks for chasing it down.
> >=20
> > I can reproduce it both ways on master-next at 6d65d74, with a
> > probe that
> > opens an fd and calls close_range(fd, ~0U, 0):
> >=20
> > =C2=A0 no PSEUDO_*_PATHS set=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 OK
> > =C2=A0 PSEUDO_IGNORE_PATHS covering the fd's path=C2=A0=C2=A0 SIGSEGV
> > =C2=A0 PSEUDO_INCLUDE_PATHS set, path not in it=C2=A0=C2=A0=C2=A0=C2=A0=
 SIGSEGV
> > =C2=A0 same env, closefrom() instead=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 OK
> > =C2=A0 all of the above, plus your line=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 OK
> >=20
> > For OP_CLOSE_RANGE the path comes from fd_path(lowfd), the ignore
> > check
> > hits it, and pseudo_client_op() returns early with result still 0,
> > which
> > close_range.c then dereferences.
> >=20
> > Two things before I respin. Do you want the three fd-protect
> > patches
> > resent, or will you carry the master-next commits since you have
> > already
> > resolved the conflicts? And the ignore-path line: fold it into the
> > close_range patch with a Suggested-by, or keep it as your own
> > commit ahead
> > of it? Either works for me.
>=20
> You can fold the above piece in with a suggested by, it doesn't make
> sense in a commit on its own. I can take the other fd-protect patches
> if you're ok with that change, I need to update the commit messages.
>=20
> Whilst most builds are testing cleanly, we are seeing these two
> failures:
>=20
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4403
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4466
>=20
> which look like a pseudo problem, and that is with the current pseudo
> master-next. I think there is still some issue remaining somewhere
> unfortunately. I'm afraid I don't know what it is.

One of those doesn't look to be pseudo, the arm one definitely does
though. It looks like it may be arch specific.

Cheers,

Richard