Karel Zak [Wed, 25 Feb 2026 10:01:02 +0000 (11:01 +0100)]
hexdump: sanitize fiemap ioctl output
Cap fm_mapped_extents to FIEMAP_EXTENTS_BATCH after each ioctl() call
to prevent potential out-of-bounds access if the kernel returns more
extents than requested.
Reported-by: Coverity Scan Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Wed, 25 Feb 2026 09:47:09 +0000 (10:47 +0100)]
dmesg: add bounds checking to parse_kmsg_timestamp()
Add 'end' pointer parameter to parse_kmsg_timestamp() to validate
buffer boundaries, consistent with parse_syslog_timestamp(),
parse_faclev(), parse_callerid(), and skip_item().
Also remove misleading "for debug messages" comment from the
null-termination in print_kmsg() -- the null-termination is required
for correctness.
Originally reported by Coverity (CID 501581, STRING_NULL). The
Coverity report itself is not valid (the buffer is properly
null-terminated before parsing), but the code was inconsistent --
parse_kmsg_timestamp() was the only parser without bounds checking.
Karel Zak [Wed, 25 Feb 2026 09:21:56 +0000 (10:21 +0100)]
libblkid: fix integer overflows in HFS+ offset calculations
Two 32-bit multiplications using on-disk values can overflow:
- leaf_node_head (uint32_t) * leaf_node_size (uint16_t) used to
calculate leaf_block; overflow produces a wrong block number,
causing reads from incorrect offsets.
- embed_first_block (uint16_t) * alloc_block_size (uint32_t) used to
calculate the embedded HFS+ volume offset; overflow truncates the
result, again causing reads from wrong offsets.
Fix by widening leaf_block and off to uint64_t and casting
multiplication operands. Bogus results from crafted images are then
safely rejected by blkid_probe_get_buffer() bounds checking and
the extent loop exhaustion.
Karel Zak [Wed, 25 Feb 2026 09:14:43 +0000 (10:14 +0100)]
libblkid: fix integer overflow in linux_raid checksum size
The checksum size calculation uses on-disk max_dev (uint32_t) multiplied
by sizeof(dev_roles[0]). On 32-bit systems, this overflows size_t,
resulting in a truncated buffer and checksum computed over wrong data,
potentially allowing crafted images to bypass validation.
Fix by computing in uint64_t. Note that blkid_probe_get_buffer() has
a hardcoded 8 MiB limit, so unreasonably large (but non-overflowed)
values are still safely rejected.
Karel Zak [Wed, 25 Feb 2026 08:58:32 +0000 (09:58 +0100)]
libblkid: fix integer overflow in nvidia_raid size check
The size validation `le32_to_cpu(nv->size) * 4 != NVIDIA_SUPERBLOCK_SIZE`
is subject to 32-bit unsigned integer overflow. A crafted value like
0x4000001E overflows when multiplied by 4, wrapping to 120 and passing
the check. The checksum loop then iterates ~1 billion times, reading
far beyond the 120-byte buffer.
Fix by comparing against the expected count directly without
multiplication. Also add a buffer size parameter to
nvraid_verify_checksum() as defense-in-depth against oversized reads.
Karel Zak [Wed, 25 Feb 2026 08:02:05 +0000 (09:02 +0100)]
Merge branch 'lsfd--socknetns-for-tuntap' of https://github.com/masatake/util-linux
* 'lsfd--socknetns-for-tuntap' of https://github.com/masatake/util-linux:
lsfd: fill SOCK.NETNS column for tuntap
lsfd: load the information of the network namespace behind a tun device
lsfd: (refactor) call ioctl(TUNGETDEVNETNS) from target_fd related methods
lsfd: add stubs of target_fd related methods to cdev_class
tests: (lsfd::*) revise the way to use "$?"
tests: (lsns::*) revise the way to use "$?"
Karel Zak [Wed, 25 Feb 2026 07:55:42 +0000 (08:55 +0100)]
fsck.cramfs: fix off-by-one heap write in do_symlink()
In do_symlink(), the decompressed symlink target is NUL-terminated by
writing outbuffer[size] = 0. The outbuffer is allocated as blksize * 2
bytes, but uncompress_block() can return up to blksize * 2, so when
size == blksize * 2 the NUL write lands one byte past the heap
allocation. Allocating one extra byte ensures the NUL terminator stays
within bounds. The stream.avail_out value remains blksize * 2, so
decompression behavior is unchanged.
Reported-by: Pavel Kohout, Aisle Research, www.aisle.com Signed-off-by: Karel Zak <kzak@redhat.com>
Masatake YAMATO [Wed, 4 Feb 2026 21:14:52 +0000 (06:14 +0900)]
lsfd: fill SOCK.NETNS column for tuntap
There are two network namespaces associated with a file descriptor
opening /dev/net/tun.
One is the device network namespace (devnetns). A tun/tap file
descriptor is associated with a network device, and the devnetns
is the namespace in which that device exists. lsfd already provides
this information via the TUN.DEVNETNS column.
The other is the socket network namespace (socknetns). A tun/tap
file descriptor is also associated with a socket, and the socknetns
is the namespace in which that socket was created. lsfd already
has the SOCK.NETNS column for reporting this information, but it
was not filled for file descriptors opening /dev/net/tun.
Masatake YAMATO [Wed, 4 Feb 2026 20:42:16 +0000 (05:42 +0900)]
lsfd: (refactor) call ioctl(TUNGETDEVNETNS) from target_fd related methods
In the original code, the attach_xinfo method of the cdev_tun_ops
struct called the ioctl. The attach_xinfo method retrieved the fd
passing to the ioctl by calling call_with_foreign_fd utility function.
In the last commit, we added the target_fd related methods in
cdev_tun_ops struct. The caller side of the target_fd related methods
calls call_with_foreign_fd.
We can reduce the code calling call_with_foreign_fd by moving the code
calling ioctl from the attach_xinfo method to the target_fd related
methods.
Karel Zak [Tue, 24 Feb 2026 08:54:12 +0000 (09:54 +0100)]
man pages: consolidate libsmartcols environment variables
Introduce man-common/env-smartcols.adoc to describe all libsmartcols
environment variables (LIBSMARTCOLS_DEBUG, LIBSMARTCOLS_DEBUG_PADDING,
LIBSMARTCOLS_JSON) in one place.
Replace duplicated LIBSMARTCOLS_DEBUG descriptions in cfdisk, fdisk,
sfdisk, findmnt, lsblk, and column man pages with an include of the
new common file.
Addresses: https://github.com/util-linux/util-linux/issues/3971 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 24 Feb 2026 11:41:39 +0000 (12:41 +0100)]
libblkid: iso9660: validate root directory to reduce false positives
The CD001 magic signature at 32KB offset can match file data content
on other filesystems (e.g. an .iso file stored on XFS whose data
blocks happen to land at the device offset where blkid looks for the
ISO 9660 Primary Volume Descriptor). This causes blkid to report
ambivalent results for a device that has only one real filesystem.
Add validation of the root directory record from the PVD: read the
root directory extent and verify that the first entry is a valid "."
self-reference (file_id_len == 1, file_id == 0x00, extent location
pointing back to itself). This check reliably rejects false positive
CD001 signatures because the root directory LBA from the PVD points
to a different location on the device that contains unrelated data.
Addresses: https://github.com/util-linux/util-linux/issues/4031 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 24 Feb 2026 08:38:09 +0000 (09:38 +0100)]
Merge branch 'feat/3971_compact_json_and_jsonl_support' of https://github.com/echoechoin/util-linux
* 'feat/3971_compact_json_and_jsonl_support' of https://github.com/echoechoin/util-linux:
jsonwrt: simplify ul_jsonwrt_empty() and add comments for COMPACT format
column: using switch-case replaces if-else
column: add JSON compact format output subtest.
column: add JSON LINES format output subtest.
column: introduce LIBSMARTCOLS_JSON environment argument
jsonwrt: support Compact JSON format output
libsmartcols: support JSON Lines format output
Karel Zak [Tue, 24 Feb 2026 08:13:15 +0000 (09:13 +0100)]
Merge branch 'libblkid_fix_cache_garbage_collection' of https://github.com/cgoesche/util-linux-fork
* 'libblkid_fix_cache_garbage_collection' of https://github.com/cgoesche/util-linux-fork:
blkid: add --garbage-collect test
libblkid: remove empty loop devices from cache when garbage collecting
Wilfred Mallawa [Mon, 23 Feb 2026 23:43:29 +0000 (09:43 +1000)]
blkzone: add more checks when printing zone write_pointer
The zone write pointer is also invalid for READONLY and OFFLINE zones, so
handle such cases appropriately by not displaying a write pointer for
READONLY and OFFLINE zones.
Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com> Fixes: b032247f48 ("blkzone: don't show wptr when zones are full")
Accessing pager_process.pid from within a signal handler is, by strict C
language interpretation, not signal safe.
Wait for all children (and thus for pager_process.pid as well) instead.
The current users dmesg and fdisk have no further children so this is a
good compromise here.
The signal handler is used for SIGINT, SIGHUP, SIGTERM, SIGQUIT. From a
terminal perspective, these are normally intercepted by the child, not
the parent.
Since wait_for_pager is never reached by a signal handler anymore, a
regular err() call is now possible. Just make sure that no exit function
handler could ever loop endlessly.
umount: new --graceful option to exit successfully even if filesystem is unmounted
This new option makes it so that umount(8) exits successfully even
if the filesystem has already been unmounted or has no directory
entry. The usefulness of this behavior becomes apparent in cases
where idempotency is important, that is the focus lies in the
destruction of the mountpoint only.
Closes: #2132 Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Karel Zak [Mon, 23 Feb 2026 13:06:57 +0000 (14:06 +0100)]
Merge branch 'lsmem_show_zones_on_uncommon_phy_mem_layout' of https://github.com/cgoesche/util-linux-fork
* 'lsmem_show_zones_on_uncommon_phy_mem_layout' of https://github.com/cgoesche/util-linux-fork:
lsmem: fix missing zone info when memory blocks start at an index other than 0
libblkid: remove empty loop devices from cache when garbage collecting
The cache garbage collection (blkid --garbage-collect) does not work for
entries of loop devices even when these have been detached. The previous
logic performed a simple stat() on the dev node path, however this is not
enough for loop devices as their nodes can remain present even if they
aren't backed by any file or other block device.
Therefore, it is more sane to verify if the loop device has a backing file
and if not, we remove it from the cache.
Closes: #4061 Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Karel Zak [Mon, 23 Feb 2026 10:00:20 +0000 (11:00 +0100)]
login: improve comments for signal handling in fork_session()
Add more detailed comments explaining the signal blocking and
sigsuspend() pattern introduced by the previous commit. The key
insight is that sigsuspend() is the actual wait point where
SIGTERM/SIGHUP are forwarded to the child, while waitpid() with
WNOHANG only performs non-blocking checks for terminated children.
lsmem: fix missing zone info when memory blocks start at an index other than 0
On systems that have an uncommon physical memory layout, e.g. where hotpluggable
memory blocks start at an offset greater than 0, we failed to set the 'have_zones'
control flag, which caused an omission of the ZONES information of the listed
individual memory block or a block range. This is because we explicitly tested for
/sys/devices/system/memory/memory0/valid_zones, however it is better to simply
look for any memory<n> directory entry and validate the existence of the valid_zones
attribute.
Closes: #4055 Signed-off-by: Christian Goeschel Ndjomouo <cgoesc2@wgu.edu>
Two cases exist in which login might send signals to a process which is
actually not a child process:
- If SIGCHLD is set to SIG_IGN by login's parent process (unlikely),
then no zombie process exists. The kernel could already reuse the PID
for another process just before login's signal_handler function sends
a signal to its stored child PID -- which was already reused
- If wait succeeds, the PID can be reused by the kernel for another
process. The registered signal_handlers could still use the stored
child PID to send signals -- but erroneously to a wrong process
Fix these cases by blocking and unblocking SIGCHLD and signal_handler
triggering signals around the wait call. Set child_pid to 0 after wait
succeeded and before signal_handler signals are unblocked again.
A user might prematurely close the pager before the parent wrote its
full output into the pipe. This triggers SIGPIPE, which would eventually
lead to an error return value.
The programs dmesg and fdisk can keep running just fine in these cases.
In fact, dmesg's source code was already prepared for EPIPE error return
values.
If the pager returns with a success return value, ignore SIGPIPE. If
there was an error within the pager, stop the parent as well.
With this, dmesg does not return an error anymore if the ring buffer was
not fully sent to the pager before it was closed.
Just calling exit with a success return value in case of an EPIPE error
in safe_fwrite is not precise enough. If dmesg was called with "-c",
i.e. to print and then clear the ring buffer, a successful return value
should mean that the ring buffer is cleared as well.
Instead, continue operation on EPIPE error but stop any further regular
output.
Karel Zak [Thu, 19 Feb 2026 11:20:28 +0000 (12:20 +0100)]
login: use original FQDN for PAM_RHOST
When login -h <remotehost> is invoked, init_remote_info() strips the
local domain suffix from the hostname (FQDN to short name) before
storing it in cxt->hostname. This truncated value is then used for
PAM_RHOST, which can bypass pam_access host deny rules that match on
the FQDN.
Preserve the original -h hostname in a new cmd_hostname field and use
it for PAM_RHOST, while keeping the truncated hostname for utmp/wtmp
and logging unchanged.
Note, the real-world impact is low -- login -h is only used by legacy
telnet/rlogin daemons, and exploitation requires FQDN-specific
pam_access rules on a system still using these obsolete services.
Reported-by: Asim Viladi Oglu Manizada <manizada@pm.me> Signed-off-by: Karel Zak <kzak@redhat.com>
Using the Linux Crypto API stores hash sums of read chunks in memory. It
trusts that get_digest is called as often as "read blocks" exist in file.
It becomes an issue with files which have less content than st_size
suggests, e.g. files in sysfs. Eventually, the iterator n will be
eq->blocksmax, because the EOF is never noticed. Writing this next hash
sum into memory would lead to an out of boundary write.
Verify that n is less than eq->blocksmax. If this is not true anymore,
treat it as an error so files are considered to be not equal. This is
much safer than erroneously treating them as equal.
Seen compiler warning with GCC 15.2.1 and glibc 2.43:
```
text-utils/pg.c: In function ‘prompt’:
text-utils/pg.c:621:24: warning: assignment discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
621 | if ((p = strstr(pstring, "%d")) == NULL) {
| ^
```
This happens if strstr is actually a preprocessor definition with a
__glibc_const_generic. For this, __GLIBC_USE (ISOC23) must be true.
Setting the pointer to const does not hurt and clarifies that the
content is not modfied.
Karel Zak [Wed, 18 Feb 2026 11:36:16 +0000 (12:36 +0100)]
Merge branch 'PR/pidfd-utils-have-defines' of https://github.com/karelzak/util-linux-work
* 'PR/pidfd-utils-have-defines' of https://github.com/karelzak/util-linux-work:
pidfd-utils: move USE_PIDFD_INO_SUPPORT after syscall fallbacks
pidfd-utils: define HAVE_PIDFD_* when syscall fallbacks are used
Karel Zak [Wed, 18 Feb 2026 09:59:30 +0000 (10:59 +0100)]
nsenter: use USE_NAMESPACE_ID_SUPPORT macro for nsid feature
Replace direct HAVE_STRUCT_NSFS_FILE_HANDLE ifdefs with a
feature-specific USE_NAMESPACE_ID_SUPPORT macro that also
requires HAVE_PIDFD_OPEN, since the namespace ID support
depends on pidfd_open().
Addresses: https://github.com/util-linux/util-linux/pull/4044 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Wed, 18 Feb 2026 09:47:19 +0000 (10:47 +0100)]
nsenter: fix minor issues with namespace ID support
- fix pidfd_self FD leak when ioctl(PIDFD_GET_MNT_NAMESPACE) fails
- fix "namesapces" typo in man page
- document "./" disambiguation for files starting with ":"
- use standard C initializer = { 0 } instead of = {}
Addresses: https://github.com/util-linux/util-linux/pull/4044 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 11:33:58 +0000 (12:33 +0100)]
setpriv: use AppArmor LSM-specific proc interface
Remove the check for /sys/kernel/security/apparmor (securityfs) before
writing to the proc attr interface. The securityfs check fails in
environments where AppArmor is enabled but securityfs is not mounted
(e.g., containers, WSL2, embedded systems).
Use the LSM-specific /proc/self/attr/apparmor/exec interface introduced
in Linux 5.8 (kernel commit 6413f852ce08) which is not affected by LSM
load ordering issues. Fall back to the legacy /proc/self/attr/exec for
older kernels.
Fixes: https://github.com/util-linux/util-linux/issues/4033 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 10:35:17 +0000 (11:35 +0100)]
lib/netlink: set SOCK_CLOEXEC on netlink socket
Set SOCK_CLOEXEC when creating the NETLINK_ROUTE socket in
ul_nl_open() to prevent the file descriptor from leaking to
child processes across execv().
In agetty, the netlink socket used to monitor IP address changes
for \4/\6 issue escapes was inherited by the login program, causing
SELinux AVC denials (local_login_t denied read/write on getty_t's
netlink_route_socket).
Fixes: https://github.com/util-linux/util-linux/issues/4032 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 10:20:38 +0000 (11:20 +0100)]
libblkid: (btrfs) use BTRFS_NR_SB_LOG_ZONES and rep->zones
Use the BTRFS_NR_SB_LOG_ZONES constant instead of a hardcoded 2 when
calling blkdev_get_zonereport() to be consistent with the rest of the
function that already uses this constant.
Replace the pointer arithmetic (struct blk_zone *)(rep + 1) with the
more readable rep->zones flexible array member access.
Addresses: https://github.com/util-linux/util-linux/pull/3995 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 10:09:09 +0000 (11:09 +0100)]
blkid: move error checks before JSON output initialization
Move the lowprobe and lookup error checks (missing device and missing
search type) before the JSON writer initialization. This prevents
partial JSON output being written to stdout before errx() terminates
the program.
Addresses: https://github.com/util-linux/util-linux/pull/4036 Signed-off-by: Karel Zak <kzak@redhat.com>
Karel Zak [Tue, 17 Feb 2026 09:56:23 +0000 (10:56 +0100)]
Merge branch 'master' of https://github.com/aschnell/util-linux
* 'master' of https://github.com/aschnell/util-linux:
avoid repetitive code
always use array with name in json output
updated test case
include device in json output and use json array when needed
If dmesg uses a pager, some of its error messages end up in the pager
output. Use the pager only for data that is supposed to be paged and
print error messages before the pager is started or after it is shut
down again.
Karel Zak [Mon, 16 Feb 2026 13:43:00 +0000 (14:43 +0100)]
prlimit: raise a nicer error message when modifying NOFILE
When attempting to set RLIMIT_NOFILE to a value exceeding the kernel's
fs.nr_open limit, prlimit(2) returns EPERM. This can mislead users into
thinking they need elevated permissions, even when running as root.
Add a check to detect when the requested NOFILE limit exceeds
fs.nr_open and provide a clear error message indicating the actual
constraint. The check is optional: if /proc/sys/fs/nr_open cannot be
read (e.g., /proc not mounted), the validation is silently skipped to
avoid introducing a hard dependency on /proc.
The nr_open value is cached and read only once per prlimit invocation
for efficiency when setting multiple limits.
Addresses: https://github.com/util-linux/util-linux/issues/4017 Co-authored-by: krajpuro <krajpuro@akamai.com> Signed-off-by: Karel Zak <kzak@redhat.com>
Michael Trapp [Tue, 10 Feb 2026 14:39:21 +0000 (15:39 +0100)]
libuuid: reset initial cont-clock time on service start
When uuidd starts with --cont-clock enabled and reads a stale timestamp
from the state file, the continuous clock logic would apply a backwards
offset (default 2 hours), causing generated UUIDs to have incorrect
timestamps in the past.
Fix this by resetting last_clock_reg to the current time when the saved
timestamp is older than the current clock. This prevents the backwards
offset from being applied at service start.
Karel Zak [Mon, 16 Feb 2026 12:30:55 +0000 (13:30 +0100)]
blkzone: make N/A string translatable
The "N/A" string for write pointer should be marked for translation
to support localization, following the pattern used elsewhere in
util-linux (e.g., blockdev.c).
Karel Zak [Mon, 16 Feb 2026 10:11:59 +0000 (11:11 +0100)]
Merge branch 'feat/3971' of https://github.com/echoechoin/util-linux
* 'feat/3971' of https://github.com/echoechoin/util-linux:
column: add bash-completion for table-header-as-columns
column: add option '--table-header-as-columns' for using first line as table columns names.
Karel Zak [Mon, 16 Feb 2026 09:45:27 +0000 (10:45 +0100)]
lib/pager: Rename caught_signal to pager_caught_signal
The variable name caught_signal is too generic. Rename it to
pager_caught_signal to follow the existing naming convention in the
file where pager-related static variables use the pager_ prefix
(pager_process, pager_argv, etc.).
Karel Zak [Mon, 16 Feb 2026 09:44:03 +0000 (10:44 +0100)]
Merge branch 'pager_fd' of https://github.com/stoeckmann/util-linux
* 'pager_fd' of https://github.com/stoeckmann/util-linux:
lib/pager: Use original stderr in pager_close
lib/pager: Use pager_open/close for pager_redirect
lib/pager: Clear potential stdout/stderr errors
lib/pager: Flush outputs in pager_close
lib/pager: Improve signal handling in pager_close
Karel Zak [Mon, 16 Feb 2026 09:18:56 +0000 (10:18 +0100)]
dmesg: update prepare_buffer() comment
The function was renamed from process_buffer() to prepare_buffer()
and no longer handles printing. Update the comment to reflect that
it only reads and prepares the message buffer.
projects / thirdparty / util-linux.git / log
