Package: libkpathsea6
Version: 2026.20260303.78225+ds-3
Severity: important
Tags: patch upstream
Dear Maintainer,
As of libkpathsea6:amd64 2026.20260303.78225+ds-3, most tex binaries do
strange stat() lookups of all siblings of the parent directories of the
input file.
The previous version of libkpathsea6, 2025.20250727.75242+ds-5+b2, did
not have this problem.
For example, somewhere under my populated home directory, I have:
origan .../tmp/silly-test $ pwd
/users/thome/tmp/silly-test
origan .../tmp/silly-test $ cat a.tex
Hello world
\bye
origan .../tmp/silly-test $ strace -o log luatex a.tex
[...]
origan .../tmp/silly-test $ grep -c fstat log
265
(with gobs of things all along the parent path, stat() to my .bashrc,
etc)
Worse, the sequence of system calls involves getdents (i.e. readdir) and
then newfstatat (i.e. lstat) on the entries that readdir sees, with a
fatal error if lstat ever fails. In addition to probably causing a race
condition, it also can happen that lstat returns EACCES. At least I do
encounter this on a probably misbehaving NFS server. However misbehaving
that server may be, it is used by many users.
In my lab, this renders all tex binaries unusable because all users have
an NFS mount point (/users) in the ancestry path of their $HOME, which
happens to have this odd behaviour (i.e. because there's a /users/abcde
which is found by readdir, yet lstat(/users/abcde) fails with EACCES).
Here's an example of what people get:
origan .../tmp/silly-test $ luatex a.tex
This is LuaTeX, Version 1.24.0 (TeX Live 2026/Debian)
restricted system commands enabled.
(./a.texluatex: abcd: Permission denied
The culprit source code upstream is
https://svn.tug.org:8369/texlive/trunk/Build/source/texk/kpathsea/xgetcwd.c?revision=78225&view=markup#l44
with the call to xlstat here
https://svn.tug.org:8369/texlive/trunk/Build/source/texk/kpathsea/xstat.c?revision=78225&view=markup#l46
Of course, it makes total sense to use the "normal" getcwd, because we
expect it to be dependable. The reason why kpathsea chooses to *NOT* use
it is because there's a configure test that goes amiss, probably because
of the new default C dialect with GCC 15, possibly in relation to changes
that went in the package with 2025.20250727.75242+ds-5+b2.
A suggested simple fix:
--- a/texk/kpathsea/configure.ac 2026-05-05 22:09:17.101211979 +0200
+++ b/texk/kpathsea/configure.ac 2026-05-05 22:08:41.332901375 +0200
@@ -48,7 +48,7 @@
[AC_RUN_IFELSE([AC_LANG_PROGRAM([[#include <stdlib.h>
int fork() { exit(1); }
int vfork() { exit(1); }
- extern char *getcwd();
+ extern char *getcwd(char *,
size_t);
char path[100];]],
[[getcwd(path,100);]])],
[kb_cv_func_getcwd_forks=no],
I rebuilt my package with this patch, the problem goes away.
Cheers,
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (900, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.19.13+deb14-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_USER
Locale: LANG=C, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libkpathsea6 depends on:
ii libc6 2.42-15
libkpathsea6 recommends no packages.
libkpathsea6 suggests no packages.
-- no debconf information
--- a/texk/kpathsea/configure.ac 2026-05-05 22:09:17.101211979 +0200
+++ b/texk/kpathsea/configure.ac 2026-05-05 22:08:41.332901375 +0200
@@ -48,7 +48,7 @@
[AC_RUN_IFELSE([AC_LANG_PROGRAM([[#include <stdlib.h>
int fork() { exit(1); }
int vfork() { exit(1); }
- extern char *getcwd();
+ extern char *getcwd(char *,
size_t);
char path[100];]],
[[getcwd(path,100);]])],
[kb_cv_func_getcwd_forks=no],
--- a/texk/kpathsea/configure.ac 2026-05-05 22:09:17.101211979 +0200
+++ b/texk/kpathsea/configure.ac 2026-05-05 22:08:41.332901375 +0200
@@ -48,7 +48,7 @@
[AC_RUN_IFELSE([AC_LANG_PROGRAM([[#include <stdlib.h>
int fork() { exit(1); }
int vfork() { exit(1); }
- extern char *getcwd();
+ extern char *getcwd(char *,
size_t);
char path[100];]],
[[getcwd(path,100);]])],
[kb_cv_func_getcwd_forks=no],
