[Pkg-rust-maintainers] Bug#1144050: virtiofsd crashes with SIGSYS (seccomp) on ther first request after a client connects

[Jonas Andradas]

Package: virtiofsd
Version: 1.14.0-2
Severity: normal
X-Debbugs-Cc: j.andradas at gmail.com

Dear Maintainer,

virtiofsd crashes with SIGSYS (seccomp) on the first request after a
client connects, making any VM with a virtiofs share fail to start.
This has been 100% reproducible on my host, standalone, with no libvirt
involved.

virtiofsd accepts the vhost-user socket connection successfully, then
is killed by its own seccomp filter (SIGSYS) apparently while calling
getsockopt(2) (syscall 55) — likely a SO_PEERCRED check on the newly
accepted socket, immediately after "Client connected, servicing
requests".

REPRODUCTION
-------------

Terminal 1:
  $ sudo /usr/libexec/virtiofsd --socket-path=/tmp/manual-vfsd.sock \
      --shared-dir=/home/user/shares --log-level=debug

Terminal 2:
  $ sudo qemu-system-x86_64 \
      -machine q35 -m 2G \
      -object memory-backend-memfd,id=mem,size=2G,share=on \
      -numa node,memdev=mem \
      -chardev socket,id=chr-vu-fs0,path=/tmp/manual-vfsd.sock \
      -device vhost-user-fs-pci,chardev=chr-vu-fs0,tag=shares \
      -display none -serial mon:stdio

Result in Terminal 1:
  [...] INFO  virtiofsd] Waiting for vhost-user socket connection...
  [...] INFO  virtiofsd] Client connected, servicing requests
  [...] ERROR virtiofsd::util] Child process terminated by signal 31

Result in Terminal 2:
  qemu-system-x86_64: -device vhost-user-fs-pci,...: Failed to read
  msg header. Read 0 instead of 12. Original request 0.
  qemu-system-x86_64: -device vhost-user-fs-pci,...: vhost_backend_init
  failed: Protocol error

KERNEL AUDIT LOG (seccomp)
---------------------------

Reproduced with --seccomp=log instead of the default enforcing mode
to confirm the exact syscall via kauditd, rather than only guessing
from the SIGSYS:

  audit: type=1326 audit(1786353556.601:476): auid=1000 uid=0 gid=0
  ses=4 subj=virtiofsd pid=120515 comm="virtiofsd-backe"
  exe="/usr/libexec/virtiofsd" sig=31 arch=c000003e syscall=55
  compat=0 ip=0x7f1be9b075ca code=0x80000000

syscall=55 on x86_64 is getsockopt.

With --seccomp=log the process survives and services requests normally, which
would point that the seccomp filter seems to be the actual blocker.

WORKAROUND
----------
Running with --seccomp=none avoids the crash entirely; the daemon
then services requests without issue. This is only being used as a
temporary unblock, not a real fix, since it disables the syscall
sandbox for the whole process.

WHAT DOES *NOT* APPEAR TO BE THE CAUSE
---------------------------------------
This was originally suspected to be a package regression, but according to
/var/log/dpkg.log and dpkg.log.1, I don't see any recent updates to the
packages I suspect could be involved (e.g. virtiofsd or libseccomp2)

- Kernel: running 7.1.6+deb14-amd64 since this morning's boot
  (2026-08-10 07:38); the first crash occurred at 08:26, before
  any package changes were made today, and 7.1.6 itself had already
  been installed
- systemd, libvirt: no relevant entries in dpkg.log/dpkg.log.1 for
  either package in the recent window (grep across both current and
  rotated logs came up empty).

- Domain XML / libvirt config: <memoryBacking> with memfd + shared
  access is present and correct; <filesystem> block is standard
  (driver type='virtiofs', accessmode='passthrough'). No config
  changes preceded the first crash.

The trigger appears to be environmental rather than a version
bump in any of the obvious candidate packages, although I am a bit lost on what
could be the change/cause.

Happy to gather more information (strace, additional kernel/glibc version
detail, etc.) on request.


Thanks,
Jonas.


-- System Information:
Debian Release: forky/sid
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (500, 'unstable'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 7.1.6+deb14-amd64 (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages virtiofsd depends on:
ii  libc6        2.42-17
ii  libcap-ng0   0.9.3-1+b1
ii  libgcc-s1    16.2.0-1
ii  libseccomp2  2.6.1-1
ii  uidmap       1:4.19.3-2

virtiofsd recommends no packages.

virtiofsd suggests no packages.

-- debconf-show failed