[rpms/flatpak] f44: Add patches to fix Epiphany crashes

[Michael Catanzaro <mcatanzaro@gnome.org>]

A new commit has been pushed.

Repo   : rpms/flatpak
Branch : f44
Commit : 7803fdf349d4b58a9e9a8b6bb90cfbb7764d8347
Author : Michael Catanzaro <mcatanzaro@gnome.org>
Date   : 2026-08-24T12:10:55-05:00
Stats  : +90/-0 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/flatpak/c/7803fdf349d4b58a9e9a8b6bb90cfbb7764d8347?branch=f44

Log:
Add patches to fix Epiphany crashes

---
diff --git a/eagain.patch b/eagain.patch
new file mode 100644
index 0000000..057b0d9
--- /dev/null
+++ b/eagain.patch
@@ -0,0 +1,37 @@
+From 5da738898bd27a81064628a7611fea85a63f96be Mon Sep 17 00:00:00 2001
+From: Sebastian Wick <sebastian.wick@redhat.com>
+Date: Tue, 18 Aug 2026 17:13:16 +0200
+Subject: [PATCH] chase: Handle EAGAIN from openat2
+
+From openat2(2):
+
+  EAGAIN how.resolve contains either RESOLVE_IN_ROOT or
+    RESOLVE_BENEATH, and the kernel could not ensure that a
+    ".." component didn't escape (due to a race condition or
+    potential attack).  The caller may choose to retry the
+    openat2() call.
+
+We should handle this by simply retrying the syscall.
+---
+ subprojects/libglnx/glnx-chase.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/subprojects/libglnx/glnx-chase.c b/subprojects/libglnx/glnx-chase.c
+index 2251cb71..49e606a3 100644
+--- a/subprojects/libglnx/glnx-chase.c
++++ b/subprojects/libglnx/glnx-chase.c
+@@ -684,7 +684,10 @@ glnx_chaseat_full (int                 dirfd,
+         .resolve = openat2_resolve,
+       };
+ 
+-      fd = openat2 (dirfd, path, &how, sizeof (how));
++      do
++        fd = openat2 (dirfd, path, &how, sizeof (how));
++      while (fd < 0 && errno == EAGAIN);
++
+       if (fd < 0)
+         {
+           /* If the syscall is not implemented (ENOSYS) or blocked by
+-- 
+2.55.0
+

diff --git a/fd-conflation.patch b/fd-conflation.patch
new file mode 100644
index 0000000..bc5df52
--- /dev/null
+++ b/fd-conflation.patch
@@ -0,0 +1,48 @@
+From 8a6709e13ca13a56f92e13f4f1c0df869f0046fc Mon Sep 17 00:00:00 2001
+From: Sebastian Wick <sebastian.wick@redhat.com>
+Date: Tue, 18 Aug 2026 16:24:15 +0200
+Subject: [PATCH] portal: Account for source fds in fd_map_remap_fd max_fd
+ tracking
+
+fd_map_remap_fd assigns a temporary fd number (++max_fd) that may later
+be used as a conflict resolution target. If the source fd passed to
+fd_map_remap_fd is higher than max_fd, conflict resolution can assign
+a replacement value that collides with that source fd. In
+child_setup_func, the dup2 for the conflicting entry then overwrites
+the source fd before it is remapped, delivering the wrong fd to the
+child process.
+
+In practice this manifests as sandbox-expose-fd-ro passing a random fd
+(e.g. a socket) instead of the intended O_PATH fd to flatpak run via
+--ro-bind-fd, producing errors like:
+
+  error: /proc/self/fd/21 resolves to non-absolute path socket:[423446]
+
+Similar error have been observed in Epiphany/WebKit:
+https://bugs.webkit.org/show_bug.cgi?id=305344
+---
+ portal/flatpak-portal.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
+index 183d3fe4..3bd68e28 100644
+--- a/portal/flatpak-portal.c
++++ b/portal/flatpak-portal.c
+@@ -619,7 +619,13 @@ fd_map_remap_fd (GArray *fd_map,
+   FdMapEntry fd_map_entry;
+ 
+   /* Use a fd that hasn't been used yet. We might have to reshuffle
+-   * fd_map_entry.to, a bit later. */
++   * fd_map_entry.to a bit later during conflict resolution, which
++   * assigns ++max_fd as replacement values. Account for the source fd
++   * in max_fd so those replacements can never collide with any source
++   * fd in the map. */
++  if (fd > *max_fd_in_out)
++    *max_fd_in_out = fd;
++
+   fd_map_entry.from = fd;
+   fd_map_entry.to = ++(*max_fd_in_out);
+   fd_map_entry.final = fd_map_entry.to;
+-- 
+2.55.0
+

diff --git a/flatpak.spec b/flatpak.spec
index f0ff4d5..8d8ea01 100644
--- a/flatpak.spec
+++ b/flatpak.spec
@@ -25,6 +25,11 @@ Source0:        https://github.com/flatpak/flatpak/releases/download/%{version}/
 Source1:        flatpak-add-fedora-repos.service
 %endif
 
+# https://github.com/flatpak/flatpak/pull/6785
+Patch:          fd-conflation.patch
+# https://github.com/flatpak/flatpak/pull/6787
+Patch:          eagain.patch
+
 # ostree not on i686 for RHEL 10
 # https://github.com/containers/composefs/pull/229#issuecomment-1838735764
 %if 0%{?rhel} >= 10