- dev - passt

[PATCH 3/3] conf, repair, tap: More caution about blocking flag on Unix sockets
by David Gibson 18 May '26

18 May '26

Most of our operation is asynchronous, based on non-blocking fds handled in our epoll loop. However, our several Unix sockets (tap client, repair helper, control client) are all blocking fds after accept(). That's correct for the repair helper, and (for now) correct for the control client. However, the reasons for that might not be obvious, so add some extra comments giving the rationale. I don't believe it's correct for the tap client; having this socket be blocking means we could potentially block the main loop if we ever got a a spurious EPOLL{IN,OUT} event on the tap socket. Switch the tap socket to non-blocking for better robustness, and consistency with nearly every other fd we track. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 6 ++++++ repair.c | 4 ++++ tap.c | 3 ++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index dec43fca..dc85f0f8 100644 --- a/conf.c +++ b/conf.c @@ -2082,6 +2082,12 @@ static void conf_accept(struct ctx *c) int fd, rc; retry: + /* Currently we perform the configuration transaction more-or-less + * synchronously, so we want the accepted socket to be blocking. + * + * FIXME: We should make the configuration update asynchronous, like + * most of our operation, so a misbehaving configuration client can't + * block the main forwarding loop */ fd = accept4(c->fd_control_listen, NULL, NULL, SOCK_CLOEXEC); if (fd < 0) { if (errno != EAGAIN) diff --git a/repair.c b/repair.c index 42c4ae97..8a2d119d 100644 --- a/repair.c +++ b/repair.c @@ -99,6 +99,10 @@ int repair_listen_handler(struct ctx *c, uint32_t events) return EEXIST; } + /* We want accepted socket to be blocking; we use it during migration + * which is a synchronous interruption to our normal non-blocking + * behaviour. + */ if ((c->fd_repair = accept4(c->fd_repair_listen, NULL, NULL, SOCK_CLOEXEC)) < 0) { if ((rc = errno) != EAGAIN) diff --git a/tap.c b/tap.c index fda2da9b..3b8a3f3d 100644 --- a/tap.c +++ b/tap.c @@ -1490,7 +1490,8 @@ void tap_listen_handler(struct ctx *c, uint32_t events) return; } - c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, SOCK_CLOEXEC); + c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, + SOCK_NONBLOCK | SOCK_CLOEXEC); if (c->fd_tap < 0) { if (errno != EAGAIN) warn_perror("Error accepting tap client"); -- 2.54.0

2 2

[PATCH] util: Fix changes to assert_with_msg()
by David Gibson 18 May '26

18 May '26

A last minute fixup to commit e51494552b78 was misapplied. Instead of improving the implementation of assert_with_msg() for the case where NDEBUG is defined, it effectively eliminated assert_with_msg() in the normal case where NDEBUG is _not_ defined. As well as removing assert()s which protect us in case of certian types of bug, this introduces some cppcheck and clang-tidy regressions. Fixes: e51494552b78 ("Fix build with -DNDEBUG") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.h b/util.h index a9dcc04c..144dc1e6 100644 --- a/util.h +++ b/util.h @@ -51,7 +51,7 @@ void abort_with_msg(const char *fmt, ...) */ #ifndef NDEBUG #define assert_with_msg(expr, ...) \ - (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) + ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) /* The standard library assert() hits our seccomp filter and dies before it can * actually print a message. So, replace it with our own version. */ @@ -61,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) __func__, __FILE__, __LINE__, STRINGIFY(expr)) #else #define assert_with_msg(expr, ...) \ - ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) #endif #ifdef P_tmpdir -- 2.54.0

2 2

[PATCH v2] util: Fix changes to assert_with_msg()
by David Gibson 17 May '26

17 May '26

A last minute fixup to commit e51494552b78 was misapplied. Instead of improving the implementation of assert_with_msg() for the case where NDEBUG is defined, it effectively eliminated assert_with_msg() in the normal case where NDEBUG is _not_ defined. As well as removing assert()s which protect us in case of certian types of bug, this introduces some cppcheck and clang-tidy regressions. Fixes: e51494552b78 ("Fix build with -DNDEBUG") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.h b/util.h index a9dcc04c..144dc1e6 100644 --- a/util.h +++ b/util.h @@ -51,7 +51,7 @@ void abort_with_msg(const char *fmt, ...) */ #ifndef NDEBUG #define assert_with_msg(expr, ...) \ - (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) + ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) /* The standard library assert() hits our seccomp filter and dies before it can * actually print a message. So, replace it with our own version. */ @@ -61,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) __func__, __FILE__, __LINE__, STRINGIFY(expr)) #else #define assert_with_msg(expr, ...) \ - ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) #endif #ifdef P_tmpdir -- 2.54.0

1 1

[PATCH 0/3] Fix broken build with -DNDEBUG
by David Gibson 17 May '26

17 May '26

Fix the trivial but nasty with -DNDEBUG builds recently reported by Jan Palus. While we're there, add a couple of extra build tests. These wouldn't actually catch this problem, but they're better than nothing and do catch the #include problem I also spotted. David Gibson (3): test: Extend exeter build tests to cover more recent binaries Fix build with -DNDEBUG test: Add test for builds with -DNDEBUG test/build/build.py | 25 +++++++++++++++++++++---- util.h | 3 ++- 2 files changed, 23 insertions(+), 5 deletions(-) -- 2.54.0

3 5

[PATCH] lib/term: Quote tr character ranges to prevent glob expansion
by Laurent Vivier 16 May '26

16 May '26

Single-letter files in the working directory cause glob expansion of unquoted tr character ranges like [A-Z] and [a-z]. When the shell expands these against matching filenames, tr receives wrong arguments and pane_or_context_run() hangs without errors. Apply the same fix as in a36031a4d807 ("seccomp.sh: Quote tr character ranges to prevent glob expansion"): quote all tr ranges in test/lib/term. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- test/lib/term | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/test/lib/term b/test/lib/term index 89e4fdbe591d..2d2d2182de14 100755 --- a/test/lib/term +++ b/test/lib/term @@ -198,7 +198,7 @@ pane_run() { # pane_wait() - Wait for command to be done in given pane name # $1: Pane name pane_wait() { - __lc="$(echo "${1}" | tr [A-Z] [a-z])" + __lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" sleep 0.01 || sleep 1 __done=0 @@ -213,7 +213,7 @@ pane_wait() { # pane_parse() - Print last line, @EMPTY@ if command had no output # $1: Pane name pane_parse() { - __pane_lc="$(echo "${1}" | tr [A-Z] [a-z])" + __pane_lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" __buf="$(tail -n2 ${LOGDIR}/pane_${__pane_lc}.log | head -n1 | sed 's/^[^\r]*\r$[^\r]$/\1/;s/[]][^]*[\]//g' | tr -d '\r\n')" @@ -267,7 +267,7 @@ pane_or_context_run() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_status "${__uc}" fi @@ -283,7 +283,7 @@ pane_or_context_run_bg() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run_bg "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" fi } @@ -303,7 +303,7 @@ pane_or_context_output() { echo "${__output}" fi else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_wait "${__uc}" pane_parse "${__uc}" @@ -318,7 +318,7 @@ pane_or_context_wait() { if context_exists "${__name}"; then context_wait "${__name}" else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_wait "${__uc}" fi } -- 2.54.0

3 2

[PATCH 0/2] Fix regression when one IP version is disabled
by David Gibson 16 May '26

16 May '26

Fix for a simple but nasty regression caused by the recent forwarding table work. Plus a tiny feature in adjacent code. Link: https://bugs.passt.top/show_bug.cgi?id=205 David Gibson (2): fwd_rule: Don't attempt dual stack listen()s if only one IP family fwd_rule: Allow parsing * as a forwarding address fwd_rule.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.54.0

2 3

Re: [PATCH 2/3] Fix build with -DNDEBUG
by David Gibson 16 May '26

16 May '26

On Fri, May 15, 2026 at 01:05:50PM +0200, Jan Palus wrote: > On 15.05.2026 14:13, David Gibson wrote: > > Since bc872d91765d, our assert() statements are omitted if we compile with > > -DNDEBUG, like the standard library assert(3). Unfortunately a trivial but > > embarrassing mistake in that patch means that instead of never aborting in > > this case, assert_with_msg() *always* aborts, breaking pretty much > > everything. > > > > There's also a missing #include that breaks the build with -DNDEBUG on at > > least some library versions. > > > > Reported-by: Jan Palus <jpalus(a)fastmail.com> > > Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()") > > Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> > > --- > > util.h | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/util.h b/util.h > > index 70aadeba..11f71d45 100644 > > --- a/util.h > > +++ b/util.h > > @@ -6,6 +6,7 @@ > > #ifndef UTIL_H > > #define UTIL_H > > > > +#include <assert.h> > > #include <stdlib.h> > > #include <stdarg.h> > > #include <stdbool.h> > > @@ -60,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) > > __func__, __FILE__, __LINE__, STRINGIFY(expr)) > > #else > > #define assert_with_msg(expr, ...) \ > > - ((void)(expr), 0 ? (void)0 : abort_with_msg(__VA_ARGS__)) > > + ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) > > There is a slight semantic difference between assert() and > assert_with_msg() when building with -DNDEBUG -- `expr` is still being > evaluated in abort_with_msg() although likely optimized out in most > builds. Right, I'm expecting the compiler to optimise this away. That won't be the case if the expression has side effects, but side effects in an assert() expression is already a bug, precisely because of the possibility NDEBUG. > I'm assuming you'd prefer to avoid cppcheck suppressions. cppcheck suppressions would be acceptable if we could put them inside the macro. But these are unused variable warnings, which show up at the site of variable declaration not (obviously) at the place the variable... isn't used. Putting suppressions on variables because they might become unused depending on a macro definition certainly isn't acceptable. Both for aesthetics, and because it means if we removed the assert we'd no longer get a warning that the variable now really isn't used. > How > about moving `expr` into branch which is never evaluated then? Would it > keep cppcheck happy? > > + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) That does work. Not sure if it's worth the bother of a respin. Stefano, any opinion? -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 2

[PATCH 3/3] test: Add test for builds with -DNDEBUG
by David Gibson 15 May '26

15 May '26

Since bc872d91765d we omit assert()s if the NDEBUG preprocessor symbol is defined, as is the case with the standard library assert(3). However, none of our tests verify that we can actually build that way. Add an extra test to test/build/build.py tto verify this. Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/build/build.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/test/build/build.py b/test/build/build.py index eeee5acc..59de014a 100755 --- a/test/build/build.py +++ b/test/build/build.py @@ -77,6 +77,20 @@ for bin in BINARIES: exeter.register('make_all', test_make, 'all', BINARIES) +(a)exeter.test +def test_ndebug() -> None: + """Test build with -NDEBUG + + Tests that we can build all binaries with -DNDEBUG (warnings are + expected, though). Doesn't test that they actually work. + """ + + with clone_sources(): + sh('make all CPPFLAGS="-DNDEBUG" CFLAGS="-w"') + for b in BINARIES: + assert Path(b).exists(), f"{b} wasn't made" + + @exeter.test def test_install_uninstall() -> None: """Test `make install` and `make uninstall` -- 2.54.0

1 0

[PATCH] ndp: Suppress Coverity false positive for random()
by Laurent Vivier 14 May '26

14 May '26

Coverity flags the random() call in ndp_timer() with the dont_call checker, warning that it should not be used for security-related applications. This is a false positive: random() is used here to jitter the interval between unsolicited Router Advertisements as required by RFC 4861, to prevent synchronisation between routers on a link. No cryptographic strength is needed. Suppress the warning with an inline Coverity annotation. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- ndp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ndp.c b/ndp.c index 1f2bcb0cc7ea..614932ac5829 100644 --- a/ndp.c +++ b/ndp.c @@ -441,6 +441,7 @@ void ndp_timer(const struct ctx *c, const struct timespec *now) * again, it's close enough for our purposes. */ interval = min_rtr_adv_interval + + /* coverity[dont_call:FALSE] */ random() % (max_rtr_adv_interval - min_rtr_adv_interval); if (!next_ra) -- 2.54.0

3 2

[PATCH v3 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element
by Laurent Vivier 14 May '26

14 May '26

Currently, the vhost-user path assumes each virtqueue element contains exactly one iovec entry covering the entire frame. This assumption breaks as some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. This series refactors the vhost-user data path so that frame lengths, header sizes, and padding are tracked and passed explicitly rather than being derived from iovec sizes. This decoupling is a prerequisite for correctly handling padding of multi-buffer frames. The changes in this series can be split in 3 groups: - New iov helpers (patches 1-2): iov_memset() and iov_memcpy() operate across iovec boundaries. These are needed by the final patch to pad and copy frame data when a frame spans multiple iovec entries. - Structural refactoring (patches 3-5): Move vnethdr setup into vu_flush(), separate virtqueue management from socket I/O in the UDP path, and pass iov arrays explicitly instead of using file-scoped state. These changes make it possible to pass explicit frame lengths through the stack, which is required to pad frames independently of iovec layout. - Explicit length passing throughout the stack (patches 6-10): Thread explicit L4, L2, frame, and data lengths through checksum, pcap, vu_flush(), and tcp_fill_headers(), replacing lengths that were previously derived from iovec sizes. With lengths tracked explicitly, the final patch can centralise Ethernet frame padding into vu_collect() and a new vu_pad() helper that correctly pads frames spanning multiple iovec entries. v3: - csum_udp4()/csum_udp6()/udp_vu_csum receive payload length (dlen) rather than l4len - Add a length parameter to write_remainder() and use it in pcap_frame() v2: - Rename iov_memcopy() to iov_memcpy() and use clearer parameter names - Use clearer code in pcap_frame() - Add braces around bodies in pcap.c and tcp_vu.c for style consistency - Extract l2len variable in tap_add_packet() and tcp_vu_send_flag() to avoid repeating the same expression - Fix indentation alignment of iov_skip_bytes() arguments in tcp_vu_c - Introduce fill_size variable in vu_flush() - Reposition comment for ETH_ZLEN in vu_collect() Laurent Vivier (10): iov: Introduce iov_memset() iov: Add iov_memcpy() to copy data between iovec arrays vu_common: Move vnethdr setup into vu_flush() udp_vu: Move virtqueue management from udp_vu_sock_recv() to its caller udp_vu: Pass iov explicitly to helpers instead of using file-scoped array checksum: Pass explicit L4 length to checksum functions pcap: Pass explicit L2 length to pcap_iov() vu_common: Pass explicit frame length to vu_flush() tcp: Pass explicit data length to tcp_fill_headers() vhost-user: Centralise Ethernet frame padding in vu_collect() and vu_pad() checksum.c | 43 +++++++----- checksum.h | 6 +- iov.c | 78 ++++++++++++++++++++++ iov.h | 5 ++ pcap.c | 28 +++++--- pcap.h | 2 +- tap.c | 10 +-- tcp.c | 14 ++-- tcp_buf.c | 3 +- tcp_internal.h | 2 +- tcp_vu.c | 66 ++++++++++--------- udp.c | 5 +- udp_vu.c | 173 +++++++++++++++++++++++++------------------------ util.c | 31 +++++++-- util.h | 3 +- vu_common.c | 58 ++++++++++------- vu_common.h | 5 +- 17 files changed, 338 insertions(+), 194 deletions(-) -- 2.53.0

3 21