Re: [yocto-patches] [pseudo] [PATCH 0/3] closefrom/close_range: protect every pseudo fd, then drop one

On Wed, 2026-07-29 at 09:14 +0100, Richard Purdie via lists.yoctoproject.or=
g wrote:
> On Wed, 2026-07-29 at 07:19 +0100, Richard Purdie via
> lists.yoctoproject.org wrote:
> > On Wed, 2026-07-29 at 05:08 +0000, Babanpreet Singh wrote:
> > > On Tue, 2026-07-28 at 16:59 +0100, Richard Purdie wrote:
> > > > I think the missing piece is this:
> > > >=20
> > > > - if (op !=3D OP_CHROOT && op !=3D OP_CHDIR && op !=3D OP_CLOSE && =
op
> > > > !=3D OP_CLOSEFROM && op !=3D OP_DUP
> > > > + if (op !=3D OP_CHROOT && op !=3D OP_CHDIR && op !=3D OP_CLOSE && =
op
> > > > !=3D OP_CLOSEFROM && op !=3D OP_CLOSE_RANGE && op !=3D OP_DUP
> > >=20
> > > Sorry for the breakage, and thanks for chasing it down.
> > >=20
> > > I can reproduce it both ways on master-next at 6d65d74, with a
> > > probe that
> > > opens an fd and calls close_range(fd, ~0U, 0):
> > >=20
> > > =C2=A0 no PSEUDO_*_PATHS set=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 OK
> > > =C2=A0 PSEUDO_IGNORE_PATHS covering the fd's path=C2=A0=C2=A0 SIGSEGV
> > > =C2=A0 PSEUDO_INCLUDE_PATHS set, path not in it=C2=A0=C2=A0=C2=A0=C2=
=A0 SIGSEGV
> > > =C2=A0 same env, closefrom() instead=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 OK
> > > =C2=A0 all of the above, plus your line=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 OK
> > >=20
> > > For OP_CLOSE_RANGE the path comes from fd_path(lowfd), the ignore
> > > check
> > > hits it, and pseudo_client_op() returns early with result still 0,
> > > which
> > > close_range.c then dereferences.
> > >=20
> > > Two things before I respin. Do you want the three fd-protect
> > > patches
> > > resent, or will you carry the master-next commits since you have
> > > already
> > > resolved the conflicts? And the ignore-path line: fold it into the
> > > close_range patch with a Suggested-by, or keep it as your own
> > > commit ahead
> > > of it? Either works for me.
> >=20
> > You can fold the above piece in with a suggested by, it doesn't make
> > sense in a commit on its own. I can take the other fd-protect patches
> > if you're ok with that change, I need to update the commit messages.
> >=20
> > Whilst most builds are testing cleanly, we are seeing these two
> > failures:
> >=20
> > https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/4403
> > https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/4466
> >=20
> > which look like a pseudo problem, and that is with the current pseudo
> > master-next. I think there is still some issue remaining somewhere
> > unfortunately. I'm afraid I don't know what it is.
>=20
> One of those doesn't look to be pseudo, the arm one definitely does
> though. It looks like it may be arch specific.

It took hours but I was able to work out this was a missing __open64_2
wrapper so I've sent a patch for that. That is unrelated to the
close_range patch but somehow implementing that triggers a different
codepath in systemd which then broke. I'll retest things and check
there isn't anything else.

Cheers,

Richard