From nobody Thu Aug 13 20:19:14 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hLcC74MwGz6pFRM for ; Thu, 13 Aug 2026 20:19:15 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hLcC71nGyz42vM for ; Thu, 13 Aug 2026 20:19:15 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786652355; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3wgV+rONHFJI/5CGVzlDBlY55sBTD2yoCUMEhYeC4ec=; b=eT5Gaco+VxSfjq+2ihDExmfvB9TeXU1DMyzmYjtDknyEdIOSh9AOaPshEygBTYe9mrTHwg gkrr14yBI6yHmO4yS2w9kyq/DAs3sHHQ9GOdx9fRTZ/gHycQt92wq9qJSJfxEqXJgXSODN jk4YWRHlSfTHsz1lcq8rO60niXZZDtTk5ME7RsvK9V9uBXlpefzmXQ73M39ttZRQM8a3Rw HRlUk6ZaIXlV/m065lnu+xZEMcn+eDTw+4wKynvp+vkgyrvfh8AgwsjdEB0xKRrTiU7xIZ NQaQYqJXNK6tC5sIzIr1Md2IhavbaDKHyCdqiR2b4lLRUBjA1JHMQ5+cGm3brQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786652355; a=rsa-sha256; cv=none; b=Qm+IjRBv/Kppqcq+POKosJD/Lp782uhw7FQUVhl4kaci68OmwuxGcZaaZRLZDjbSpP/pCk VtKZ/PD3qsMXZvkGcWY/nKK2JzqEofJ5jCFVqRdtxpdSgxwcADwtV/3ttPoF3MuP0ytW4J fKN5gfZ+tGsnoB4rAGA/elMWtNdYO+oP8VRsPHsoSCHHZ3x4atspy7ew78YrT57OdxdMS/ iM167i8lNPEBmrpswtgw+hlR3QUBO2kKLt1Ival5FwCNElVqhRvdy6HNLBW2hlNW/DDGSU XwDTf+3HlF7TpfcY8Y3zxKFxCN71cWmdtvXgIiUIZQC7xIQfuy23zsFDXPpTiQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786652355; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3wgV+rONHFJI/5CGVzlDBlY55sBTD2yoCUMEhYeC4ec=; b=VTg+UxFJDFI70ZBvN+XnxzYvgtG1+aiQloD3y+W/+gMpUeuKV4sXiqgPZW3ITsNkvmQPee b2WmLW5Igygv5QMNK58x3NklyN9hlonWOJ9UeQOAP5YlAz8LCfJBohiTRO+fLsqXVHtEr2 ibTyYK6eQKvuUzt47VNY5PSUeFVuAKZ1Gui3/WPq119duq1Ft5kVydJ73A1qh+cg2r2JtN 8XmUm2UpRmn8dV4zkAvLlonyDEpa16PIzv5CNMmsDzYH6OvrKYYw9YOqmkjQ4sCKQ+CpWX +pGf2ek+c1R+bjDEcBjjUtiJx9PXj/qF0v/AwfK0JlwLW6jsFu7Bp4zYPV7EDg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hLcC674ZhzB91 for ; Thu, 13 Aug 2026 20:19:14 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 38521 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 13 Aug 2026 20:19:14 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Devin Teske Subject: git: 3baada83bf2d - main - unix: only treat an empty sun_path as a peer descriptor for connectat(2) List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dteske X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 3baada83bf2deb48c7251f8de3f73e489338d4f1 Auto-Submitted: auto-generated Date: Thu, 13 Aug 2026 20:19:14 +0000 Message-Id: <6a7e26c2.38521.5b8ace20@gitrepo.freebsd.org> The branch main has been updated by dteske: URL: https://cgit.FreeBSD.org/src/commit/?id=3baada83bf2deb48c7251f8de3f73e489338d4f1 commit 3baada83bf2deb48c7251f8de3f73e489338d4f1 Author: Devin Teske AuthorDate: 2026-08-13 20:17:09 +0000 Commit: Devin Teske CommitDate: 2026-08-13 20:17:09 +0000 unix: only treat an empty sun_path as a peer descriptor for connectat(2) connect(2) passes AT_FDCWD to unp_connectat(), so the empty-path descriptor branch added in 6563dcb6b1f5 turned any sockaddr whose sun_path begins with a NUL byte into getsock(AT_FDCWD), failing with EBADF where the pathname lookup historically failed with ENOENT. Linux abstract namespace names are exactly that: the linuxulator passes them through with the leading NUL intact, and libxcb tries the abstract socket first, falling back to the pathname socket only on ENOENT or ECONNREFUSED. The EBADF made every Linux X11 client fail at startup with "Missing X server or $DISPLAY". Restrict the descriptor interpretation to fd != AT_FDCWD, matching the contract stated in 6563dcb6b1f5's commit message ("Accept an empty sun_path when fd is not AT_FDCWD"): connect(2) again reaches the pathname lookup and fails with ENOENT as it always did. Add a regression test: a NUL-leading, nonzero-length sun_path through connect(2) or connectat(2) with AT_FDCWD must fail the pathname lookup with ENOENT, not EBADF. Fixes: 6563dcb6b1f5 ("unix: allow connectat(2) to name the peer socket by descriptor") Reviewed by: John Ericson , markj Differential Revision: https://reviews.freebsd.org/D58792 --- sys/kern/uipc_usrreq.c | 2 +- tests/sys/kern/unix_connectat.c | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index 8c67b623323e..1e1f340bd0c1 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -3115,7 +3115,7 @@ unp_connectat_peer(struct thread *td, int fd, const char *buf, * fallback; if not, it may be an O_PATH handle for a bound socket's * vnode, so fall through to an EMPTYPATH lookup. */ - if (*buf == '\0') { + if (*buf == '\0' && fd != AT_FDCWD) { error = unp_socket_fd_peer(td, fd, so2p); if (error != ENOTSOCK) return (error); diff --git a/tests/sys/kern/unix_connectat.c b/tests/sys/kern/unix_connectat.c index 9861287f5362..04885ee464ee 100644 --- a/tests/sys/kern/unix_connectat.c +++ b/tests/sys/kern/unix_connectat.c @@ -78,6 +78,13 @@ static const struct sockaddr_un empty_sun = { .sun_len = offsetof(struct sockaddr_un, sun_path), }; +/* A nonempty address whose path starts with NUL, as Linux abstract names do. */ +static const struct sockaddr_un nul_sun = { + .sun_family = AF_UNIX, + .sun_len = offsetof(struct sockaddr_un, sun_path) + 2, + .sun_path = "\0x", +}; + /* Make a bound, listening stream socket. */ static int mklistener(const char *path) @@ -657,6 +664,32 @@ ATF_TC_BODY(empty_path_at_fdcwd, tc) ATF_REQUIRE_EQ(0, close(s)); } +/* + * A NUL-leading path with a nonzero length is not the empty-path + * extension: connect(2) and connectat(2) with AT_FDCWD must perform a + * pathname lookup and fail with ENOENT, not treat AT_FDCWD as a peer + * descriptor and fail with EBADF. + * + * Such addresses occur in the wild: they name Linux abstract namespace + * sockets, and the linuxulator passes them through with the leading NUL + * intact. libxcb tries the abstract X11 socket first and falls back to + * the pathname socket only on ENOENT or ECONNREFUSED, so when connect(2) + * briefly returned EBADF here, every Linux X11 client on the linuxulator + * failed at startup with "Missing X server or $DISPLAY". + */ +ATF_TC_WITHOUT_HEAD(nul_path_at_fdcwd); +ATF_TC_BODY(nul_path_at_fdcwd, tc) +{ + int s; + + ATF_REQUIRE((s = socket(PF_UNIX, SOCK_STREAM, 0)) >= 0); + ATF_REQUIRE_ERRNO(ENOENT, connect(s, + (const struct sockaddr *)&nul_sun, nul_sun.sun_len) == -1); + ATF_REQUIRE_ERRNO(ENOENT, connectat(AT_FDCWD, s, + (const struct sockaddr *)&nul_sun, nul_sun.sun_len) == -1); + ATF_REQUIRE_EQ(0, close(s)); +} + /* Error matrix for unsuitable descriptors and peers. */ ATF_TC_WITHOUT_HEAD(bad_peers); ATF_TC_BODY(bad_peers, tc) @@ -763,6 +796,7 @@ ATF_TP_ADD_TCS(tp) ATF_TP_ADD_TC(tp, devfd_mode_rdlnk); ATF_TP_ADD_TC(tp, devfd_mode_nodup_rdlnk); ATF_TP_ADD_TC(tp, empty_path_at_fdcwd); + ATF_TP_ADD_TC(tp, nul_path_at_fdcwd); ATF_TP_ADD_TC(tp, bad_peers); ATF_TP_ADD_TC(tp, cap_connectat); ATF_TP_ADD_TC(tp, cap_connectat_denied);