From d651df8283ce62d2f03f8abe5cd4798bd1b8bf58 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 17 Apr 2026 14:55:29 +0200 Subject: [PATCH 1/4] nspawn: avoid passing NULL to log_syntax() If range is NULL (i.e. when PrivateUsers= doesn't contain ':'), both later error paths will then pass NULL to log_syntax(): ~# cat foo.nspawn [Exec] PrivateUsers=9999999999999999999 ~# SYSTEMD_LOG_LEVEL=debug systemd-nspawn -D foo |& grep foo.nspawn Found settings file: /root/foo.nspawn /root/foo.nspawn:2: UID/GID shift invalid, ignoring: (null) or ~# cat foo.nspawn [Exec] PrivateUsers=4294967294 ~ # SYSTEMD_LOG_LEVEL=debug systemd-nspawn -D foo |& grep foo.nspawn Found settings file: /root/foo.nspawn /root/foo.nspawn:2: UID/GID shift and range combination invalid, ignoring: (null) Let's just use rvalue in both of these cases instead. --- src/nspawn/nspawn-settings.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/nspawn/nspawn-settings.c b/src/nspawn/nspawn-settings.c index 9abd5024a5..30c603394c 100644 --- a/src/nspawn/nspawn-settings.c +++ b/src/nspawn/nspawn-settings.c @@ -720,12 +720,12 @@ int config_parse_private_users( r = parse_uid(shift, &sh); if (r < 0) { - log_syntax(unit, LOG_WARNING, filename, line, r, "UID/GID shift invalid, ignoring: %s", range); + log_syntax(unit, LOG_WARNING, filename, line, r, "UID/GID shift invalid, ignoring: %s", rvalue); return 0; } if (!userns_shift_range_valid(sh, rn)) { - log_syntax(unit, LOG_WARNING, filename, line, 0, "UID/GID shift and range combination invalid, ignoring: %s", range); + log_syntax(unit, LOG_WARNING, filename, line, 0, "UID/GID shift and range combination invalid, ignoring: %s", rvalue); return 0; } From c859d41232b3bcff9f9b01f1281c1b202f15d0b2 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 17 Apr 2026 15:51:40 +0200 Subject: [PATCH 2/4] namespace: don't log misleading error in the r > 0 path fd_is_fs_type() returns < 0 for errors, 0 for false, and > 0 for true, so in the r > branch we'd most likely report EPERM together with the error message which is misleading. --- src/core/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/namespace.c b/src/core/namespace.c index ff4592b8b9..1412ccce8b 100644 --- a/src/core/namespace.c +++ b/src/core/namespace.c @@ -3662,7 +3662,7 @@ static int unpeel_get_fd(const char *mount_path, int *ret_fd) { _exit(EXIT_FAILURE); } if (r > 0) { - log_debug_errno(r, "'%s' is still an overlay after opening mount tree: %m", mount_path); + log_debug("'%s' is still an overlay after opening mount tree", mount_path); _exit(EXIT_FAILURE); } From 774a9f440bebeea960b69bb46109d72b3d7b8667 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 17 Apr 2026 19:52:53 +0200 Subject: [PATCH 3/4] strxcpyx: add a paranoia check for vsnprintf()'s return value vsnprintf() can, under some circumstances, return negative value, namely during encoding errors when converting wchars to multi-byte characters. This would then wreak havoc in the arithmetics we do following the vsnprintf() call. However, since we never do any wchar shenanigans in our code it should never happen. Let's encode this assumption into the code as an assert(), similarly how we already do this in other places (like strextendf_with_separator()). --- src/basic/strxcpyx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/basic/strxcpyx.c b/src/basic/strxcpyx.c index dc40d620e7..f8410f7d0c 100644 --- a/src/basic/strxcpyx.c +++ b/src/basic/strxcpyx.c @@ -64,6 +64,8 @@ size_t strpcpyf_full(char **dest, size_t size, bool *ret_truncated, const char * i = vsnprintf(*dest, size, src, va); va_end(va); + assert(i >= 0); + if (i < (int) size) { *dest += i; size -= i; From 6182d0c66654594c65c680bc0e486d8bbcb359f5 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Sat, 18 Apr 2026 19:22:40 +0200 Subject: [PATCH 4/4] import: fix an always-true assert() --- src/import/pull-tar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/import/pull-tar.c b/src/import/pull-tar.c index a235c2fba3..fe18636eb7 100644 --- a/src/import/pull-tar.c +++ b/src/import/pull-tar.c @@ -445,7 +445,7 @@ static void tar_pull_job_on_finished(PullJob *j) { else if (j == p->settings_job) log_info_errno(j->error, "Settings file could not be retrieved, proceeding without."); else - assert("unexpected job"); + assert_not_reached(); } /* This is invoked if either the download completed successfully, or the download was skipped because