nexoniarz/SchOS
nexoniarz/SchOS
Watch
1
0
Fork
You've already forked SchOS
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

libinput, seatd and libseat; sockets from accept() can pass descriptors

Browse source 
Alpine's libinput, libseat, seatd, xf86-input-libinput and usbutils join the
image, and seatd runs from schinit. libinput lists the keyboard and pointer as
an ordinary user, Xorg now drives both through libinput, and a program linked
to libseat running as schos opens seat0 through seatd, is handed
/dev/input/event0 and reads its name through the descriptor.

Two kernel bugs stood in the way, and both would have stopped a Wayland
compositor too. The socket connect() queues for a listener was allocated with
its domain at zero, so sendmsg refused SCM_RIGHTS on the accepted end: a server
could receive descriptors and never send one. And sendmsg treated a control
buffer longer than its messages as an error, where Linux takes a following
header too short to be one as the end; seatd passes a zeroed CMSG_SPACE array
with one descriptor at the front.

Found with /proc/strace and a temporary kinfo in sendmsg's EINVAL sites.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EVRhxi9zpdW2uDUN4FVcao
This commit is contained in:
Nexoniarz 2026-10-26 16:51:39 +01:00
commit b411836478
8 changed files with 94 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
kernel/sys/sys_net.c
View file

@ -913,6 +913,13 @@ scm_gather(struct msghdr *m, struct file **fs, int *nfp)
for (off = 0; off + sizeof(struct cmsghdr) <= m->msg_controllen; ) {
c = (struct cmsghdr *)(buf + off);
// The control buffer may be longer than its messages: seatd passes
// the whole of a zeroed CMSG_SPACE(MAX_FDS) array with one descriptor
// in it. Linux's CMSG_NXTHDR treats a following header too short to
// be one as the end, not as an error, and so does this. (A first
// header that short is still wrong.)
if (off > 0 && c->cmsg_len < sizeof(struct cmsghdr))
break;
if (c->cmsg_len < CMSG_LEN(0) || c->cmsg_len > m->msg_controllen - off) {
r = -EINVAL;
goto fail;