May 2026 - dev

[PATCH v2 0/3] More caution with NONBLOCK flag on Unix sockets
by David Gibson 20 May '26

20 May '26

This is a revision of the one patch from my pesto series that wasn't merged: a rework to the handling of the blocking flag for both listening and accepted Unix sockets. This new version is split into several pieces to make the rationales clearer at each step. It's also a bit more cautious in what it does, so should avoid the problems with the original version. David Gibson (3): treewide: Add SOCK_CLOEXEC to accept() calls that are missing it tap: Report accept() errors conf, repair, tap: Document reasons for blocking Unix sockets conf.c | 6 ++++++ repair.c | 9 +++++++-- tap.c | 13 +++++++++++-- 3 files changed, 24 insertions(+), 4 deletions(-) -- 2.54.0

2 5

[PATCH v9 0/3] vhost-user,udp: Handle multiple iovec entries per virtqueue element
by Laurent Vivier 20 May '26

20 May '26

Some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. Currently, the RX (host to guest) path assumes a single iovec per element, which triggers: ASSERTION FAILED in virtqueue_map_desc (virtio.c:403): num_sg < max_num_sg This series reworks the UDP vhost-user receive path to support multiple iovec entries per element, fixing the iPXE crash. This series only addresses the UDP path. TCP vhost-user will be updated to use multi-iov elements in a subsequent series. Based-on: 20260513115218.1662850-1-lvivier(a)redhat.com v9: - iov_push_header_(): skip memcpy() when the source pointer already aliases the iov buffer - udp_update_hdr4()//udp_update_hdr6()/usp_csum(): update payload doc - udp_tap_prepare(): use existing (*tap_iov)[UDP_IOV_PAYLOAD] v8: - Add Reviewed-by from David for 1/3 and 2/3 - Remove VLA to use fixed size (VIRTQUEUE_MAX_SIZE) - Rename udp_frame to datagram - Use sizeof(uh) instead of sizeof(struct udphdr) - Push back uh in memory in udp_vu_csum() v7: - In udp_vu_sock_to_tap(), introduce iov_still_needed variable - Fix iov_tail @data doc comments in udp_vu_prepare()/udp_vu_csum() - Don't rewrap the virtio checksum comment in udp_update_hdr6() - Add NULL check for uh in udp_vu_csum() v6: - Rebased on top of [PATCH 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element v5: - This version doesn't change the padding system regarding v4, it's a complex task that will be addressed in another version - reorder patches and add new patches - remove IOV_PUT_HEADER()/with_header() and introduce IOV_PUSH_HEADER() - don't use the iov_tail to provide the headers to the functions - move vu_set_vnethdr() to vu_flush(), extract vu_queue_notify() - move vu_flush() inside loop in tcp_vu_data_from_sock() to flush data by frame and not by full data length v4: - rebase - replace ASSERT() by assert() v3: - include the series "Decouple iovec management from virtqueues elements" - because of this series, drop: "vu_common: Accept explicit iovec counts in vu_set_element()" "vu_common: Accept explicit iovec count per element in vu_init_elem()" "vu_common: Prepare to use multibuffer with guest RX" "vhost-user,udp: Use 2 iovec entries per element" - drop "vu_common: Pass iov_tail to vu_set_vnethdr()" as the specs insures a buffer is big enough to contain vnet header - introduce "with_header()" and merge "udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()" and "udp_vu: Use iov_tail in udp_vu_prepare()" to use it v2: - add iov_truncate(), iov_memset() - remove iov_tail_truncate() and iov_tail_zero_end() - manage 802.3 minimum frame size Laurent Vivier (3): udp_vu: Allow virtqueue elements with multiple iovec entries iov: Introduce IOV_PUSH_HEADER() macro udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() iov.c | 30 +++++++++++++ iov.h | 11 +++++ udp.c | 73 ++++++++++++++++--------------- udp_internal.h | 4 +- udp_vu.c | 116 ++++++++++++++++++++++++++----------------------- 5 files changed, 142 insertions(+), 92 deletions(-) -- 2.54.0

2 6

[PATCH] ip: Wrap CASE macro body in braces for pre-C23 compatibility
by Anshu Kumari 20 May '26

20 May '26

From: Jeskynar <jeskynar(a)gmail.com> Compiling on RHEL8 (gcc-8.5) gives an error in ip.c. ip.c:88:3: error: a label can only be part of a statement and a declaration is not a statement due to the use of static_assert. The fix is to surround it with {}. Link: https://bugs.passt.top/show_bug.cgi?id=201 Signed-off-by: Anshu Kumari <anskuma(a)redhat.com> --- ip.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ip.c b/ip.c index f2506bb..7b674e0 100644 --- a/ip.c +++ b/ip.c @@ -35,9 +35,9 @@ const char *ipproto_name(uint8_t proto) { switch (proto) { #define CASE(s) \ - static_assert(sizeof(s) <= IPPROTO_STRLEN, \ - "Increase IPPROTO_STRLEN to contain " #s); \ - return s; + {static_assert(sizeof(s) <= IPPROTO_STRLEN, \ + "Increase IPPROTO_STRLEN to contain " #s); \ + return s;} case IPPROTO_ICMP: CASE("ICMP"); case IPPROTO_TCP: -- 2.54.0

4 3

[PATCH] selinux: Allow pasta to create and use its control socket when started by Podman
by Stefano Brivio 19 May '26

19 May '26

If Podman starts us, we need to be able to create and use a UNIX domain socket file under ifconfig_var_run_t or container_var_run_t: add the related permissions. The failure reported by Jan would have been fixed by a simple: allow pasta_t ifconfig_var_run_t:sock_file create; but we'll need more than that for actual operation with pesto(1), and to cover all possible cases. Reported-by: Jan Rodák <jrodak(a)redhat.com> Link: https://github.com/containers/podman/pull/28478 Fixes: 533577008942 ("selinux: Add file context and type enforcement for pesto") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index fb51416..ff74dd7 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -253,6 +253,8 @@ allow pasta_t container_var_run_t:dir { add_name open rmdir write }; allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; allow pasta_t container_var_run_t:file { create open write }; allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:sock_file { getattr create open read write }; +allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; # Allow pasta to bind to any port -- 2.43.0

1 0

[PATCH v2 2/3] tap: Report accept() errors
by David Gibson 18 May '26

18 May '26

Currently, if accept4() fails in tap_listen_handler(), we carry on as if it succeeded. Something will probably fail shortly down the line, but that's needlessly confusing. Report an error instead. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tap.c b/tap.c index e7cac9df..660f1cb6 100644 --- a/tap.c +++ b/tap.c @@ -1491,6 +1491,10 @@ void tap_listen_handler(struct ctx *c, uint32_t events) } c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, SOCK_CLOEXEC); + if (c->fd_tap < 0) { + warn_perror("Error accepting tap client"); + return; + } if (!getsockopt(c->fd_tap, SOL_SOCKET, SO_PEERCRED, &ucred, &len)) info("accepted connection from PID %i", ucred.pid); -- 2.54.0

1 0

[PATCH 3/3] conf, repair, tap: More caution about blocking flag on Unix sockets
by David Gibson 18 May '26

18 May '26

Most of our operation is asynchronous, based on non-blocking fds handled in our epoll loop. However, our several Unix sockets (tap client, repair helper, control client) are all blocking fds after accept(). That's correct for the repair helper, and (for now) correct for the control client. However, the reasons for that might not be obvious, so add some extra comments giving the rationale. I don't believe it's correct for the tap client; having this socket be blocking means we could potentially block the main loop if we ever got a a spurious EPOLL{IN,OUT} event on the tap socket. Switch the tap socket to non-blocking for better robustness, and consistency with nearly every other fd we track. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 6 ++++++ repair.c | 4 ++++ tap.c | 3 ++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index dec43fca..dc85f0f8 100644 --- a/conf.c +++ b/conf.c @@ -2082,6 +2082,12 @@ static void conf_accept(struct ctx *c) int fd, rc; retry: + /* Currently we perform the configuration transaction more-or-less + * synchronously, so we want the accepted socket to be blocking. + * + * FIXME: We should make the configuration update asynchronous, like + * most of our operation, so a misbehaving configuration client can't + * block the main forwarding loop */ fd = accept4(c->fd_control_listen, NULL, NULL, SOCK_CLOEXEC); if (fd < 0) { if (errno != EAGAIN) diff --git a/repair.c b/repair.c index 42c4ae97..8a2d119d 100644 --- a/repair.c +++ b/repair.c @@ -99,6 +99,10 @@ int repair_listen_handler(struct ctx *c, uint32_t events) return EEXIST; } + /* We want accepted socket to be blocking; we use it during migration + * which is a synchronous interruption to our normal non-blocking + * behaviour. + */ if ((c->fd_repair = accept4(c->fd_repair_listen, NULL, NULL, SOCK_CLOEXEC)) < 0) { if ((rc = errno) != EAGAIN) diff --git a/tap.c b/tap.c index fda2da9b..3b8a3f3d 100644 --- a/tap.c +++ b/tap.c @@ -1490,7 +1490,8 @@ void tap_listen_handler(struct ctx *c, uint32_t events) return; } - c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, SOCK_CLOEXEC); + c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, + SOCK_NONBLOCK | SOCK_CLOEXEC); if (c->fd_tap < 0) { if (errno != EAGAIN) warn_perror("Error accepting tap client"); -- 2.54.0

2 2

[PATCH] util: Fix changes to assert_with_msg()
by David Gibson 18 May '26

18 May '26

A last minute fixup to commit e51494552b78 was misapplied. Instead of improving the implementation of assert_with_msg() for the case where NDEBUG is defined, it effectively eliminated assert_with_msg() in the normal case where NDEBUG is _not_ defined. As well as removing assert()s which protect us in case of certian types of bug, this introduces some cppcheck and clang-tidy regressions. Fixes: e51494552b78 ("Fix build with -DNDEBUG") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.h b/util.h index a9dcc04c..144dc1e6 100644 --- a/util.h +++ b/util.h @@ -51,7 +51,7 @@ void abort_with_msg(const char *fmt, ...) */ #ifndef NDEBUG #define assert_with_msg(expr, ...) \ - (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) + ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) /* The standard library assert() hits our seccomp filter and dies before it can * actually print a message. So, replace it with our own version. */ @@ -61,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) __func__, __FILE__, __LINE__, STRINGIFY(expr)) #else #define assert_with_msg(expr, ...) \ - ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) #endif #ifdef P_tmpdir -- 2.54.0

2 2

[PATCH v2] util: Fix changes to assert_with_msg()
by David Gibson 17 May '26

17 May '26

A last minute fixup to commit e51494552b78 was misapplied. Instead of improving the implementation of assert_with_msg() for the case where NDEBUG is defined, it effectively eliminated assert_with_msg() in the normal case where NDEBUG is _not_ defined. As well as removing assert()s which protect us in case of certian types of bug, this introduces some cppcheck and clang-tidy regressions. Fixes: e51494552b78 ("Fix build with -DNDEBUG") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.h b/util.h index a9dcc04c..144dc1e6 100644 --- a/util.h +++ b/util.h @@ -51,7 +51,7 @@ void abort_with_msg(const char *fmt, ...) */ #ifndef NDEBUG #define assert_with_msg(expr, ...) \ - (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) + ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) /* The standard library assert() hits our seccomp filter and dies before it can * actually print a message. So, replace it with our own version. */ @@ -61,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) __func__, __FILE__, __LINE__, STRINGIFY(expr)) #else #define assert_with_msg(expr, ...) \ - ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) #endif #ifdef P_tmpdir -- 2.54.0

1 1

[PATCH 0/3] Fix broken build with -DNDEBUG
by David Gibson 17 May '26

17 May '26

Fix the trivial but nasty with -DNDEBUG builds recently reported by Jan Palus. While we're there, add a couple of extra build tests. These wouldn't actually catch this problem, but they're better than nothing and do catch the #include problem I also spotted. David Gibson (3): test: Extend exeter build tests to cover more recent binaries Fix build with -DNDEBUG test: Add test for builds with -DNDEBUG test/build/build.py | 25 +++++++++++++++++++++---- util.h | 3 ++- 2 files changed, 23 insertions(+), 5 deletions(-) -- 2.54.0

3 5

[PATCH] lib/term: Quote tr character ranges to prevent glob expansion
by Laurent Vivier 16 May '26

16 May '26

Single-letter files in the working directory cause glob expansion of unquoted tr character ranges like [A-Z] and [a-z]. When the shell expands these against matching filenames, tr receives wrong arguments and pane_or_context_run() hangs without errors. Apply the same fix as in a36031a4d807 ("seccomp.sh: Quote tr character ranges to prevent glob expansion"): quote all tr ranges in test/lib/term. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- test/lib/term | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/test/lib/term b/test/lib/term index 89e4fdbe591d..2d2d2182de14 100755 --- a/test/lib/term +++ b/test/lib/term @@ -198,7 +198,7 @@ pane_run() { # pane_wait() - Wait for command to be done in given pane name # $1: Pane name pane_wait() { - __lc="$(echo "${1}" | tr [A-Z] [a-z])" + __lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" sleep 0.01 || sleep 1 __done=0 @@ -213,7 +213,7 @@ pane_wait() { # pane_parse() - Print last line, @EMPTY@ if command had no output # $1: Pane name pane_parse() { - __pane_lc="$(echo "${1}" | tr [A-Z] [a-z])" + __pane_lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" __buf="$(tail -n2 ${LOGDIR}/pane_${__pane_lc}.log | head -n1 | sed 's/^[^\r]*\r$[^\r]$/\1/;s/[]][^]*[\]//g' | tr -d '\r\n')" @@ -267,7 +267,7 @@ pane_or_context_run() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_status "${__uc}" fi @@ -283,7 +283,7 @@ pane_or_context_run_bg() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run_bg "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" fi } @@ -303,7 +303,7 @@ pane_or_context_output() { echo "${__output}" fi else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_wait "${__uc}" pane_parse "${__uc}" @@ -318,7 +318,7 @@ pane_or_context_wait() { if context_exists "${__name}"; then context_wait "${__name}" else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_wait "${__uc}" fi } -- 2.54.0

3 2