Patterns such as foo_@v/bar.efi are documented to
match files in versioned subdirectories,
but pattern_match() assumed that a field is
always followed by a literal when another element exists.
Handle a following slash as a delimiter too,
and request another recursion step
when the current path ends before that slash.
core: connect to sockets in credential directories
Recursive credential directory loading intentionally
includes socket entries, but load_credential()
only enabled AF_UNIX socket handling for absolute paths.
Let the recursive directory path request socket
connections explicitly, and update the stale comment for directory-fd reads.
sysupdate: load a per-component *.component file (#42935)
This is split out of #42651, because for some reason Claude refuses to
review that PR, probably because it's too large. Hence let's try this
piecemeal.
This has integration tests in #42651 (which passed). And docs too.
When copying a directory into an image, open an existing destination
with O_NOFOLLOW before passing it to copy_tree_at(). This rejects a
symlink used as the final destination component without a separate
stat-before-use check.
Previously the pre-opened destination followed that symlink. That
allowed --copy-to to be redirected outside the image root when the
image was a directory tree.
If the destination does not exist yet, keep delegating creation to
copy_tree_at(). Real existing directories still use COPY_MERGE through
the opened directory fd.
shared: fix DNS RR wire cache and EFI boot option bounds checks (#42926)
Invalidate cached DNS RR wire format when
`dns_resource_record_clamp_ttl()` updates `rr->ttl` in place.
Validate each EFI `Boot####` device-path node length before reading
subtype-specific fields.
journal-remote: do not create /var/log/journal/remote (#42937)
This handling with tmpfiles was dropped in 29444df23bea21c15a3284ad8acfe2f008e5dbae. So let's stop the build system
to create that directory. Actually it is create by the service just
fine, including correct access mode.
Kai Lüke [Wed, 8 Jul 2026 15:25:11 +0000 (00:25 +0900)]
stub: Prefer graphical console over virtio detection heuristic
With vmspawn --console=gui and similar one has the case where the VirtIO
PCI device is present for something else than the console and the logic
in sd-stub added console=hvc0 even though it didn't exist. This caused
tty0 to be empty during boot.
Always prefer the graphical console before a potential virtio console.
The virtio console is still preferred over a serial console and we can
get the same problem there, e.g., qemu-guest-agent is used causing the
PCI device but without a virtio console and instead a serial console is
used. This is not solved here.
When seat_trigger_devices() produces no pending uevents,
seat_triggered_uevents_done() runs in the same call stack as
session_start() and tests session->started before the assignment
further down. The check fails, session_device_resume_all() is
skipped, and the compositor never receives DRM master.
Set started before seat_read_active_vt() so the gate sees the
correct value, and document the ordering constraint at the call
site to prevent regression.
Reproducible with greetd plus a Wayland compositor on the same VT
on kernel 6.19+.
Christian Hesse [Wed, 8 Jul 2026 17:37:38 +0000 (19:37 +0200)]
journal-remote: do not create /var/log/journal/remote
This handling with tmpfiles was dropped in 29444df23bea21c15a3284ad8acfe2f008e5dbae. So let's stop the build system
to create that directory. Actually it is create by the service just
fine, including correct access mode.
efi_get_boot_option() validates the overall Boot#### variable size and
the advertised device-path byte count, but then walks each device-path
node without first checking that the node header and subtype payload fit
in the remaining buffer.
A malformed Boot#### variable could make the parser read past the end of
the current node, or past the available device-path data.
Limit parsing to the bytes that are actually present, and stop walking
the device path when a malformed node is encountered. This keeps the
previous best-effort behaviour for fields parsed before the anomaly while
avoiding out-of-bounds reads.
dns_resource_record_clamp_ttl() may patch the TTL in place when the
record has a single reference. dnssec_fix_rrset_ttl() also updates TTLs
after canonical wire-format data may have been cached.
If a record already has cached wire-format data, that cache still
contains the old TTL and dns_resource_record_to_wire_format() will keep
reusing it.
Add a small helper to clear the cached wire-format state, and use it
whenever the TTL changes. This makes subsequent serialization match the
record fields.
Michal Sekletar [Tue, 30 Jun 2026 13:19:27 +0000 (15:19 +0200)]
socket-util: fix socket_xattr_supported() in initramfs
Don't test xattr support on socket created in filesystem. This doesn't
work in initramfs when /tmp doesn't have tmpfs mounted inside as
initramfs doesn't have xattr support. Setting socket xattr falls back to
parent directory xattr handlers when we work with FS based socket.
Let's test sockfs based socket instead so that the check is generic and
works in all environments.
resolved: honour per-link DNSOverTLS=yes for certificate verification
dnstls_stream_connect_tls() reads the manager-wide dns_over_tls_mode
field directly, so when the global mode was 'no' or 'opportunistic' but
a link was configured with strict DNSOverTLS=yes, the DoT connection
was established without SSL_VERIFY_PEER or hostname/IP checks.
Use dns_server_get_dns_over_tls_mode() which honours the per-link
override.
When a rate limit is armed, for example via StartLimitInterval=, and the
machine is suspended, the rate limit's "clock" is suspended as well,
since the elapse checks use CLOCK_MONOTONIC. This then causes unexpected
situations where a rate limit armed via StartLimitInterval=1h, followed
by a 10 hour suspend, would elapse after 11 hours total.
Let's avoid this by switching the rate limits to CLOCK_BOOTTIME, which
works the same as CLOCK_MONOTONIC, but accounts for the time spent in
suspend as well.
There's one slight concern when it comes to upgrade path - the old
"begin" value of the rate limit is stored as CLOCK_MONOTONIC, but after
upgrading systemd and serializing/deserializing the state it will be
suddenly compared against now(CLOCK_BOOTTIME), which might cause some
rate limits to elapse "prematurely". But this is just a one-time thing,
after which the rate limit timers should re-assess themselves.
fsck_mode_from_string() and fsck_repair_from_string() return -EINVAL
on a bad value. Store the result in a local variable first, and only
update the global state on success.
Otherwise an invalid value is logged as ignored, but still leaves a
negative enum value behind. In the fsck.repair case that makes
fsck_repair_option_to_string() return NULL and truncates the fsck
command line.
bootctl: Fix prepend when installing systemd-boot for the first time
In commit 38433a6d06ef ("bootctl: rework bootctl-install.c in preparation of varlinkification"),
the `first` argument of install_boot_option() was reworked to use the
new InstallContext struct/InstallOperation. `first` was intended to
indicate if we were on the install path, so the check should be
== INSTALL_NEW, not != INSTALL_NEW.
Fixes: 38433a6d06ef ("bootctl: rework bootctl-install.c in preparation of varlinkification")
measure-smbios: bound type 1 length before zeroing wake-up type
The structure length comes from the firmware SMBIOS table and the only
bound before the fixed-offset wake_up_type write was an assert(), which
is a no-op in release sd-boot builds.
Whether the field is present is governed by the formatted-area length
header->length, not the total size which also covers the trailing string
set. A too-short record (an old SMBIOS 2.0 one, or a crafted 6-byte
header) makes the offset-24 write land past the xmemdup() copy; a record
with a short formatted area but long string set instead gets a stable
string byte zeroed in the copy. Key the guard off header->length and the
field offset, matching get_smbios_table(), and measure such records
as-is. Zero only the part of the field that lies within the formatted
area, and collapse the two measure_smbios_raw() call sites by selecting
what to measure via a pointer.
Signed-off-by: Syed Mohammed Nayyar <jmestwa@gmail.com>
Lars Sjöstrom [Thu, 2 Jul 2026 08:08:03 +0000 (10:08 +0200)]
core: support stdio fd passing in io.systemd.Unit.StartTransient
Add StandardInputFileDescriptor, StandardOutputFileDescriptor and
StandardErrorFileDescriptor to the Service context of the Varlink
StartTransient() method. Each carries the push-order index of a file descriptor
passed along with the method call (via SCM_RIGHTS), and connects it to the
transient service's standard input/output/error. This is the Varlink equivalent
of the StandardInputFileDescriptor= / StandardOutputFileDescriptor= /
StandardErrorFileDescriptor= D-Bus transient properties behind
"systemd-run --pipe", which had no Varlink counterpart.
The manager Varlink server now enables SD_VARLINK_SERVER_ALLOW_FD_PASSING_INPUT
so clients may attach descriptors to their method calls, matching other
fd-accepting Varlink services (mountfsd, networkd, vmspawn, ...). The indices are
resolved with sd_varlink_peek_dup_fd() after the polkit authorization check and
stored on the Service exactly like the D-Bus path
(bus_set_transient_exec_context_fd()): the fds land in stdin_fd/stdout_fd/
stderr_fd and exec_context.stdio_as_fds is set, so the existing exec-invoke
plumbing wires them to the spawned process unchanged. Unsuitable fds (bad
index, wrong access mode) are rejected as InvalidParameter, other resolution
failures propagate as raw errnos.
Add coverage to TEST-74-AUX-UTILS.varlinkctl-unit.sh, passing regular files as
the stdout/stderr fds and asserting the unit's output lands on them.
sysinstall: Disable timeout for connection with repart
The repart connection was timeing out when fetching candidate devices.
Therfore disable the timeout and keep the connection open till the user
disconnects.
portable: fix marker_matches_images() and propagate errors correctly
marker_matches_images() was declared to return bool, but several of its
paths return a negative errno (OOM, parse errors, etc.). A negative int
coerces to true, so every such failure was reported as a "match".
Return int with the tristate semantics the callers already expect.
When detaching by image name instead of the original path, path_pick() may
not resolve a concrete path (e.g. a runtime overlay). Keep comparing the
caller-provided image name, and use the picked path only as an additional
canonical match when it exists.
journald: replace existing syslog event source before reopening
manager_open_syslog_socket() may be called again with an already open
syslog fd. In that case the old syslog event source still watches the
fd, so adding a new IO source for the same fd fails with -EEXIST and
leaves the old source installed.
Disable and unref the old event source before adding the replacement.
This keeps reopening idempotent and avoids leaving a stale event source
around.
journald: pin the sending client's context across native message dispatch
manager_process_native_message() looks up the sender's ClientContext with
client_context_get(), which does not pin it.
A native message may carry an OBJECT_PID=, which makes
manager_dispatch_message_real() perform a nested client_context_get() for that
PID. On a cache miss this runs client_context_try_shrink_to(), whose pid-flush
branch frees every unpinned cache entry whose PID has already been reaped,
including the borrowed sender context. manager_dispatch_message_real() then keeps
using it (it reads c->uid, and the built iovecs still alias the context's
fields).
Pin the sender context with client_context_acquire() for the duration of the
dispatch and release it afterwards, mirroring what the stdout stream path
already does.
Commit edea370222 (portable: remove drop-in configs even if the main unit file does not exist)
taught detach to handle leftover .service.d directories
after the main unit symlink was removed.
portable_get_state_internal() still had the same blind
spot: it only considered regular unit entries, so portablectl
is-attached could report detached while a portable drop-in directory was still present.
Handle those drop-in-only entries like detach does, preserve
the existing unit-file based enabled checks when the
main unit file is still present, and add TEST-29 coverage.
sbsign: write unaligned signature size into WIN_CERTIFICATE header
The inclusion of padding bytes in the signature size can lead to the signature
being rejected by strict PKCS7 parsers. Meanwhile, according to [1], the parser
of the WIN_CERTIFICATE structure is expected to round up the value of dwLength
to an 8-byte multiple. This also matches the behaviour of the sbsign tool from
sbsigntools.
Once link_tmpfile_at() succeeds, the target path
has been published. Avoid unlinking it on later
close or parent fsync failures when COPY_REPLACE
was used, as that can remove the replaced target.
meson: build .standalone versions of the report binaries
The goal is to be allow the use of those binaries on systemd with older
systemd. The report stuff is generally independent of the running systemd
version.
When built with -Dinstall-tests=true -Dstandalone-binaries=true
-Dbuildtype=release -Db_lto=true, gcc-16.1.1-2.fc44.x86_64, the sizes
are quite reasonable:
We have two concepts: a list of files that should be extracted from an
intermediate build artifact to be used in a later build artifact, and for a
given artifact, a list "donors". The first list was called "extract", because
it is passed to the .extract_objects() meson function, and the second was
called "objects", because that is the meson parameter to specify pre-built
objects files (6350d2dbd97746440b9c8303ddc140ffda568732). But this naming is
confusing: we don't care about the 'extract' step, this is something internal
to the build machinery. And 'objects' is a very generic term.
Let's use 'export' for the stuff that is "exported" for other binaries to use,
and 'import' to say where to import from. Those terms are symmetrical and the
association between them should be intuitive. (If you think the terms are
actually assymetrical, there are precedents for confusing the import with the
import sources. E.g. in modern English, turkeys are called so because they were
imported from the Americas and guineafowls were imported from Africa via
Türkiye and all that foreign stuff is alike.)
* 45c16dd369 Use uniform format for %rhel conditionals
* 034fa693f2 Print the build status also in %build
* 3cc7e03365 Restore definitions of helper macros
* 2382c910b7 Disable the standalone report yet again
* 2d6fd95c70 Restore explicit requires for Centos Stream 9 and 10
* 521ab0fb09 test: skip the integration test suite on Fedora ELN (for now)
* 453447b79b rpminspect: ignore test-coredump-stacktrace in annocheck
* 9d4edaa576 test: work around a kernel bug in virtio/vsock
* c53b2fb307 test: cap the number of parallel tests
* 9bd26bb71f Fix ntpvendor for ELN
* de7b685908 Disable reqs for dlopen'ed libraries on CentOS
* 4830641844 Move portabled to systemd-container subpackage
* 893fcd9978 Add missing conditionalization and more debugging
* c783e74791 split-files: improve error message
* ee2dff42d6 Add systemd-report-standalone
* 9c87a3f8ad Load libssl.so.4 rather than libssl.so.3
* 714b0799d2 Version 261.1
* 054158500a Update to load openssl-4 rather than openssl-3
* 5a3e750ef8 Version 261
* 4faee7ab7d Version 261~rc4
* 8ff635a921 Rebuilt for openssl 4.0
* 0064f73d97 Rebuilt for openssl 4.0
* 14a9aac87e Use dlopen notes again
* 720fa8259a Do not check ownership of /var/lib/systemd/timesync/ in rpm -V
* 06bd9926f2 Version 261~rc3
* 6ddbd499e8 Drop unused tree build dependency
* bd81a14bfc Version 261~rc2
Michael Vogt [Thu, 2 Jul 2026 13:27:06 +0000 (15:27 +0200)]
journalctl: add follow mode to the varlink method
This commit implements `journalctl -f` like behavior for the
varlink API of journalctl. It is used via:
```
$ varlinkctl call -E \
/run/systemd/io.systemd.JournalAccess \
io.systemd.JournalAccess.GetEntries '{"follow": true, "limit": 10}'
```
This gives the last 10 message and then it keeps the connection
open and output each new log line that matches the set filters.
The code is modeled after `journalctl -f`. It seems there is little
to extract into shared code here so I left it for now.
resolve: anchor the service browser from mDNS maintenance queries
mdns_maintenance_query() takes a ref on the browser's varlink link but
never installs itself as that link's userdata. dns_query_free() then
unconditionally runs sd_varlink_set_userdata(varlink_request, NULL),
so freeing any maintenance query wipes the browse query's registration
on the shared sb->link slot, disabling the abort paths in
vl_on_disconnect() and dns_service_browser_free(). The maintenance
query also never takes a reference on the DnsServiceBrowser, so a client
disconnect could free the browser while a maintenance query was still
in flight, leaving the per-service schedule_event timer and the raw
service->service_browser back-pointer dangling (use-after-free on the
next timer tick or query completion).
Take a service_browser_request reference instead, matching the browse
query path. dns_query_free() already drops it. The browser now outlives
its in-flight maintenance queries.
link_request_sr_iov_vfs() queued each request with a raw SRIOV* as
userdata and a NULL free_func, so the request did not own the object.
The SRIOV is owned by link->network->sr_iov_by_section, which is freed
by network_free() on reload while the RTM_SETLINK reply may still be in
flight (the floating netlink slot keeps the request alive but does not
keep the userdata alive). A later reply, or the 25s netlink timeout,
then dispatches sr_iov_handler() which reads the freed SRIOV.
udev: clear event back-pointer when freeing a worker
worker_free() did not clear worker->event->worker, leaving an event
that was still attached to a worker pointing at freed memory once the
worker was gone. manager_free() frees the workers (hashmap_free())
before it walks manager->events to process them, and event_free() then
writes event->worker->event = NULL into the already-freed worker.
Clear the back-pointer in worker_free(), mirroring event_free() which
already clears the worker's pointer. The link used to be torn down by
the event_free(worker->event) call in worker_free(), which was dropped
when events became reference counted.
The Event and Worker definitions move to udev-manager.h (next to
Manager) so the unit test can construct and free a bound worker/event
pair.
sd-bus: drop half-registered vtable members on failure
add_object_vtable_internal() inserts BusVTableMember entries into the
global vtable_methods/vtable_properties sets as it walks the vtable, but
only sets node_vtable.node (which gates the disconnect-time cleanup)
after the loop. A failure mid-loop thus left the already-inserted
members behind, dangling once the slot's interface string and the node's
path were freed, so a later registration reading those keys hit a
use-after-free. Remove this slot's members on the fail path.
The test asserts the failed registration leaves no member behind.
sd-bus: re-check match_callbacks_modified in the argNhas value loop
The CAN_HASH branch of bus_match_run() that iterates the array values of
an argNhas= match dispatches a callback per value but, unlike the leaf
and manual-iteration branches, does not re-check bus->match_callbacks_modified
afterwards. A callback that adds or removes a match (freeing the node)
would then have the next hashmap_get(node->compare.children, ...) read
freed memory. Add the same check the sibling branches already have.
sd-netlink: disconnect the slot on async/match error paths
netlink_slot_allocate() links the slot into nl->slots and takes an nl
reference, but sd_netlink_call_async() and netlink_add_match_internal()
hold it in a _cleanup_free_, so an error after allocation frees the slot
with a bare free()
network: initialize dot_servers before CLEANUP_ARRAY
If dns_resolvers_to_dot_addrs() fails (e.g. OOM) it returns without
assigning *ret_addrs, so the CLEANUP_ARRAY() cleanup would free an
uninitialized dot_servers pointer on the error return.
udev: track remaining buffer size across $links devlinks
FORMAT_SUBST_LINKS passes the same 'l' (remaining size) to strpcpy for
each devlink and discards the returned remaining value, so the cursor
advances while the bound stays at the full size, overflowing dest.
Capture the return value.
hashmap: honor the value destructor in set_ensure_consume()
Sets store their element in the key slot but use a value destructor
(DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR). On the reject/duplicate path
set_ensure_consume() only checked free_key and otherwise called free().
The tag-match loop emits 6 instructions per tag into a fixed 512-entry
stack array without a bounds check (unlike the subsystem loop below),
so enough tags overflow the stack. Refuse with -E2BIG instead.
Paul Meyer [Fri, 3 Jul 2026 13:52:10 +0000 (15:52 +0200)]
vmspawn: allow opt-in Secure Boot firmware for coco
CoCo firmware is stateless, so Secure Boot keys cannot be enrolled at
runtime: it only enforces Secure Boot with keys baked in at build time,
refusing unsigned images from the first boot. The default exclusion of
the enrolled-keys firmware feature hence keeps unsigned images bootable,
but it also makes firmware discovery fail on distros that only ship
SNP/TDX firmware with pre-enrolled keys (e.g. Fedora's TDVF). Drop the
rejection of --secure-boot=yes with --coco= and instead treat it as an
opt-in to such firmware, by lifting the enrolled-keys exclusion.
While at it, reject --efi-nvram-template= and an explicit
--efi-nvram-state= path with --coco=, which were silently ignored, as
stateless firmware has no NVRAM to instantiate or persist.
Paul Meyer [Thu, 2 Jul 2026 16:04:36 +0000 (18:04 +0200)]
vmspawn: verify selected fw matches requirements
Carry the firmware descriptor's feature list in OvmfConfig, and verify
that firmware selected via an explicit --firmware= descriptor declares
the amd-sev-snp/intel-tdx feature, is stateless, and is in raw format,
the same constraints automatic discovery already imposes. This replaces
the cached supports_sb boolean with a generic feature lookup.
Paul Meyer [Thu, 2 Jul 2026 14:22:36 +0000 (16:22 +0200)]
vmspawn: select coco firmware via fw descriptors
Instead of requiring --firmware= to point at a raw .fd image for
--coco=sev-snp/tdx, pick a suitable firmware automatically from the
QEMU firmware descriptors, requiring the amd-sev-snp/intel-tdx feature.
CoCo firmware is stateless (it carries no NVRAM template), so teach
find_ovmf_config() to select stateless raw-format firmware via new
flags. --firmware= now uniformly takes a firmware descriptor path.
hwdb: map mic-mute key on Logitech K950 (Bluetooth)
The mic-mute key on the Logitech K950 keyboard (046D:B388, Bluetooth)
emits BTN_0 (scancode 0x100e1) instead of a usable key, so it does
nothing under GNOME/KDE. Map it to KEY_MICMUTE, its intended function.
logind: drop the seat from the GC queue after draining its devices
manager_gc() pops a seat off m->seat_gc_queue and clears
seat->in_gc_queue before calling seat_free(). seat_free() then drains
the seat's devices, and device_detach() calls seat_add_to_gc_queue() for
a seat that just lost its last master device, re-prepending the dying
seat onto m->seat_gc_queue. seat_free() removed itself from the queue up
front, before that drain, so the re-queued seat is left on the queue as a
dangling pointer once mfree() runs.
logind: cancel long-press timers when the Button is freed
The four *_long_press_event_source timers are Manager-scoped but armed
by start_long_press() with the specific Button that started the press as
their userdata. button_free() unrefs only the Button's own io and check
event sources, never these timers. If the input device backing the
Button is unplugged while a long press is in progress,
manager_process_button_device()'s REMOVE branch calls button_free() and
the still-armed timer fires up to LONG_PRESS_DURATION (5s) later,
dereferencing the freed Button as userdata (b->manager, b->seat).
Cancel each long-press timer the Button owns (matched by userdata) in
button_free().
Also unref all four sources in manager_free() instead of just the reboot
one, for symmetry at daemon teardown.
logind: don't free live SessionDevice on duplicate TakeDevice
method_take_device() declares its local with
_cleanup_(session_device_freep), but the "device already taken" check
assigns a borrowed hashmap pointer to it and returns immediately:
sd = hashmap_get(s->devices, &dev);
if (sd)
return sd_bus_error_set(error, BUS_ERROR_DEVICE_IS_TAKEN, ...);
On that return the cleanup attribute runs session_device_free() on the
still-live entry that s->devices continues to own and use.
A subsequent ReleaseDevice then fails with BUS_ERROR_DEVICE_NOT_TAKEN
and the caller is left holding a revoked fd.
Translations update from [Fedora
Weblate](https://translate.fedoraproject.org) for
[systemd/main](https://translate.fedoraproject.org/projects/systemd/main/).
For some reason claude refuses to review
https://github.com/systemd/systemd/pull/42651.
Let's see if we can make it work by splitting up the big PR into smaller
ones. So here's the first one with 5 commits that should be relatively
easy to review and get merged early.
Luca Boccassi [Fri, 26 Jun 2026 22:12:54 +0000 (23:12 +0100)]
boot: require a minimum PE optional header size in verify_pe()
verify_pe() only checked SizeOfOptionalHeader against a SIZE_MAX wrap (a
clause that, given SizeOfOptionalHeader is a uint16_t, can never reject
anything) and never read NumberOfRvaAndSizes. But pe_kernel_info(),
pe_kernel_check_nx_compat() and pe_kernel_check_no_relocation() then read
SizeOfImage, AddressOfEntryPoint, DllCharacteristics and the base
relocation data directory entry from the optional header.
Require SizeOfOptionalHeader to be large enough to contain everything down
to the base relocation data directory entry, and require the image to
declare that many data directory entries.
Luca Boccassi [Fri, 26 Jun 2026 21:17:28 +0000 (22:17 +0100)]
boot: restore parent loaded image when initrd registration fails
linux_exec() patches the stub's own EFI_LOADED_IMAGE_PROTOCOL to point
at the loaded inner kernel, and restores the saved original only after
the entry point returns. The initrd_register() failure path returns
without restoring, leaving the firmware's protocol pointing to freed
data.
Luca Boccassi [Fri, 26 Jun 2026 21:10:20 +0000 (22:10 +0100)]
boot: restore RW/RO memory attributes on every error
linux_exec() marks code sections RO+X for W^X and reverts them to RW+NX
in a loop just before returning, because EDK2 requires freed buffers to
be writable and non-executable or FreePages() crashes. Not every error
path is currently covered. Switch to a _cleanup_ helper so that every
return path is covered.
Luca Boccassi [Fri, 26 Jun 2026 20:58:57 +0000 (21:58 +0100)]
boot: check PE section against SizeOfImage
pe_locate_sections_internal() stores each matching section's VirtualSize
and VirtualAddress into PeSectionVector.memory_size/memory_offset with
only SIZE_MAX overflow guards, never checking them against the image's
SizeOfImage.
Wire up the image's SizeOfImage down to pe_locate_sections_internal()
and skip any section whose in-memory section does not fit within it.
Luca Boccassi [Fri, 26 Jun 2026 19:12:36 +0000 (20:12 +0100)]
boot: bound PE section VirtualSize before zeroing the inner kernel
The inner-kernel section loader checks VirtualAddress + SizeOfRawData
against kernel_size_in_memory (for the memcpy), but the memzero right
after it clears up to VirtualAddress + VirtualSize, and VirtualSize is
only constrained to be >= SizeOfRawData.
Reject a VirtualAddress + VirtualSize that overflows or exceeds
kernel_size_in_memory, mirroring the existing SizeOfRawData checks.
Luca Boccassi [Fri, 26 Jun 2026 18:57:23 +0000 (19:57 +0100)]
boot: reject inner kernel entry point outside the image
pe_kernel_info() returned AddressOfEntryPoint (and the .compat section
entry_point) straight from the PE header with no check against
SizeOfImage. Since cab9c7b5a4 the stub calls the inner kernel directly
as ImageBase + entry_point, and only EFI_SIZE_TO_PAGES(SizeOfImage) pages
are allocated for it.
Luca Boccassi [Fri, 26 Jun 2026 18:41:31 +0000 (19:41 +0100)]
boot: don't unquote an empty value in line_get_key_value()
de0da85d41b switched the unquote check to strchr8(QUOTES, value[0]),
which is not equivalent to the old explicit comparison for an empty
value: strchr8(), like strchr(3), returns a pointer to the haystack's
terminating NUL when the needle is '\0', so strchr8(QUOTES, '\0') is
non-NULL. For a line whose separator is the last byte (e.g. "ID=") the
split leaves value[0] == '\0' and line[linelen - 1] == '\0' too, so both
conjuncts hold and value++ steps one byte past the value's terminator.
Luca Boccassi [Fri, 26 Jun 2026 16:29:31 +0000 (17:29 +0100)]
boot: initialize return parameters on zero-length EFI variable read
When a variable exists but is empty, the initial size-query
GetVariable() in efivar_get_raw_full() returns EFI_SUCCESS instead of
EFI_BUFFER_TOO_SMALL: the zero-length payload already "fits" the
zero-length query buffer. The helper returns success, but does not
initialize the return parameters.
Handle a couple of corner cases by checking the return size.
Luca Boccassi [Fri, 26 Jun 2026 16:21:52 +0000 (17:21 +0100)]
boot: make device_path_next_node() robust against malformed zero-length nodes
device_path_next_node() advances by the current node's Length field,
which per the EFI device path protocol includes the 4-byte node header;
a well-formed node is therefore at least sizeof(EFI_DEVICE_PATH) bytes
long. A malformed node with Length < sizeof(EFI_DEVICE_PATH), in
particular Length == 0, makes the helper return its input pointer
unchanged.
projects / thirdparty / systemd.git / log
