core: assorted hardening fixes flagged by kres (#42840)

src/core/bpf-restrict-fs.c

@@ -173,7 +173,10 @@ int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer
                         if (magic[i] == 0)
                                 break;
 
-                        if (sym_bpf_map_update_elem(inner_map_fd, &magic[i], &dummy_value, BPF_ANY) != 0) {
+                        /* The map key is uint32_t but statfs_f_type_t may be 64-bit, pass a truncated copy
+                         * to avoid breaking on big endian arches. */
+                        uint32_t key = magic[i];
+                        if (sym_bpf_map_update_elem(inner_map_fd, &key, &dummy_value, BPF_ANY) != 0) {
                                 r = log_error_errno(errno, "bpf-restrict-fs: Failed to update BPF map: %m");
 
                                 if (sym_bpf_map_delete_elem(outer_map_fd, &cgroup_id) != 0)

src/core/main.c

@@ -543,8 +543,10 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
                         return 0;
 
                 r = unbase64mem(value, &p, &sz);
-                if (r < 0)
+                if (r < 0) {
                         log_warning_errno(r, "Failed to parse systemd.random_seed= argument, ignoring: %s", value);
+                        return 0;
+                }
 
                 free(arg_random_seed);
                 arg_random_seed = sz > 0 ? p : mfree(p);
@@ -2121,7 +2123,7 @@ static int do_reexecute(
                 char* argv[],
                 const struct rlimit *saved_rlimit_nofile,
                 const struct rlimit *saved_rlimit_memlock,
-                FDSet *fds,
+                FDSet *_fds, /* donated */
                 const char *switch_root_dir,
                 const char *switch_root_init,
                 uint64_t saved_capability_ambient_set,
@@ -2137,6 +2139,9 @@ static int do_reexecute(
         assert(saved_rlimit_memlock);
         assert(ret_error_message);
 
+        /* The fdset is donated to us, take ownership so it is freed on all exit paths. */
+        _cleanup_fdset_free_ FDSet *fds = TAKE_PTR(_fds);
+
         /* Close and disarm the watchdog, so that the new instance can reinitialize it, but the machine
          * doesn't get rebooted while we do that. */
         watchdog_close(/* disarm= */ true);
@@ -3846,7 +3851,7 @@ finish:
                                  argc, argv,
                                  &saved_rlimit_nofile,
                                  &saved_rlimit_memlock,
-                                 fds,
+                                 TAKE_PTR(fds),
                                  switch_root_dir,
                                  switch_root_init,
                                  saved_ambient_set,

src/core/scope.c

@@ -437,6 +437,10 @@ static int scope_start(Unit *u) {
         if (IN_SET(s->state, SCOPE_STOP_SIGTERM, SCOPE_STOP_SIGKILL))
                 return -EAGAIN;
 
+        /* Already starting up (waiting for the async cgroup chown helper)? Then there's nothing to do. */
+        if (s->state == SCOPE_START_CHOWN)
+                return 0;
+
         assert(s->state == SCOPE_DEAD);
 
         if (!u->transient && !MANAGER_IS_RELOADING(u->manager))

src/quotacheck/quotacheck.c

@@ -36,9 +36,11 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat
                 if (proc_cmdline_value_missing(key, value))
                         return 0;
 
-                arg_mode = quota_check_mode_from_string(value);
-                if (arg_mode < 0)
-                        log_warning_errno(arg_mode, "Invalid quotacheck.mode= value, ignoring: %s", value);
+                QuotaCheckMode mode = quota_check_mode_from_string(value);
+                if (mode < 0)
+                        log_warning_errno(mode, "Invalid quotacheck.mode= value, ignoring: %s", value);
+                else
+                        arg_mode = mode;
 
         } else if (streq(key, "forcequotacheck") && !value)
                 arg_mode = QUOTA_CHECK_FORCE;
@@ -54,9 +56,11 @@ static void parse_credentials(void) {
         if (r < 0)
                 log_debug_errno(r, "Failed to read credential 'quotacheck.mode', ignoring: %m");
         else {
-                arg_mode = quota_check_mode_from_string(value);
-                if (arg_mode < 0)
-                        log_warning_errno(arg_mode, "Invalid 'quotacheck.mode' credential, ignoring: %s", value);
+                QuotaCheckMode mode = quota_check_mode_from_string(value);
+                if (mode < 0)
+                        log_warning_errno(mode, "Invalid 'quotacheck.mode' credential, ignoring: %s", value);
+                else
+                        arg_mode = mode;
         }
 }
 

src/shared/install.c

@@ -2438,8 +2438,10 @@ int unit_file_unmask(
                                    path_is_generator(&lp, info.path)) {
                                 r = install_changes_add(changes, n_changes,
                                                         INSTALL_CHANGE_IS_MASKED_GENERATOR, info.name, info.path);
-                                if (r < 0)
+                                if (r < 0) {
+                                        TAKE_PTR(info.name); /* Return the borrowed name before bailing */
                                         return r;
+                                }
                         }
 
                         TAKE_PTR(info.name);  /* … and give it back here */