os: doInRoot does not resolve relative paths that land on root

[ghost]

Go version

1.24.2

Output of go env in your module/workspace:

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/mo/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/mo/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/nix-shell-27134-0/go-build1931540400=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/mo/Code/goteleport-interview/int-fs-mo-hijazi/go.mod'
GOMODCACHE='/home/mo/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/mo/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/mo/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.2'
GOWORK=''

What did you do?

1. Setup a os.Root
2. Use root.Lstat to access the root directory using a relative path (subdir/..)

What did you see happen?

When using os.Root as follows:

root, err :=  os.OpenRoot("/home")
//...
root.Lstat("mo/..")

I get the following panic:

2025/05/19 11:02:47 http2: panic serving 127.0.0.1:56042: runtime error: index out of range [0] with length 0
goroutine 43 [running]:
net/http.(*http2serverConn).runHandler.func1()
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/h2_bundle.go:6522 +0x13e
panic({0x722f80?, 0xc000020630?})
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/runtime/panic.go:792 +0x132
os.doInRoot[...](0xc00008a1b0, {0xc00017a146, 0x5}, 0xc0001958d8)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/os/root_openat.go:133 +0xbfe
os.rootStat(0xc000192930?, {0xc00017a146, 0x5}, 0x24?)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/os/root_unix.go:117 +0x56
os.(*Root).Lstat(0xc00008a1b0, {0xc00017a146, 0x5})
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/os/root.go:162 +0x3e
github.com/goteleport-interview/fs4/api/helpers.validatePath({0x73f9b3, 0x5}, {0xc00017a146, 0x5})
        /home/mo/Code/goteleport-interview/int-fs-mo-hijazi/api/helpers/directory_helpers.go:45 +0x267
github.com/goteleport-interview/fs4/api/helpers.GetDirectoryList({0x73f9b3, 0x5}, {0xc00017a146?, 0x6d9580?})
        /home/mo/Code/goteleport-interview/int-fs-mo-hijazi/api/helpers/directory_helpers.go:63 +0xf7
github.com/goteleport-interview/fs4/api/handlers.DirectoryListHandler({0x7ea938, 0xc000124020}, 0xc00016a4ab?)
        /home/mo/Code/goteleport-interview/int-fs-mo-hijazi/api/handlers/directory.go:15 +0xcc
net/http.HandlerFunc.ServeHTTP(0xc0000d40c0?, {0x7ea938?, 0xc000124020?}, 0x0?)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/server.go:2294 +0x29
net/http.(*ServeMux).ServeHTTP(0x59bf37?, {0x7ea938, 0xc000124020}, 0xc00015e780)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/server.go:2822 +0x1c4
net/http.serverHandler.ServeHTTP({0x59bf37?}, {0x7ea938?, 0xc000124020?}, 0xa28860?)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/server.go:3301 +0x8e
net/http.initALPNRequest.ServeHTTP({{0x7eb0e8?, 0xc00020a7e0?}, 0xc000254008?, {0xc00019c000?}}, {0x7ea938, 0xc000124020}, 0xc00015e780)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/server.go:3974 +0x231
net/http.(*http2serverConn).runHandler(0xa28860?, 0x0?, 0x0?, 0xc000304000?)
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/h2_bundle.go:6529 +0xf5
created by net/http.(*http2serverConn).scheduleHandler in goroutine 26
        /nix/store/zi2fbsywdxyc8j48x05yi52xpr1399lg-go-1.24.2/share/go/src/net/http/h2_bundle.go:6463 +0x21d

Following the trace I found it originates in go/src/os/root_openat.go:133. After resolving a .. path, there is no check to ensure path is not empty, causing the path[i] lookup to throw a panic.

What did you expect to see?

To get Lstat results for my root folder

[gabyhelp]

Related Issues

• net/http: panic if path value is an asterisk #67067 (closed)
• os: OpenRoot follows symlinks #71806 (closed)
• go/build: Passes bad $GOROOT to `go list` subprocess #35056 (closed)
• x/net/http2: id(*) < evictCount(*) panic #72940 (closed)
• net/http: ServeFile panics when StripPrefix over-strips and results in empty path #30165
• os: `GOOS=wasip1 GOARCH=wasm` the `ReadFile` function gives `-1` as the `rootFd` to `path_open` causing `Bad file number` error #63466
• cmd/go: go get panics in GOPATH mode on custom import path with an insecure redirect #34049 (closed)
• x/tools/internal: panic, "GOROOT not set in evaluated environment" #40670 (closed)
• path/filepath: TestEvalSymlinksAboveRoot failure on macOS #35201 (closed)
• cmd/addr2line: TestAddr2Line fails with double / in $GOROOT_FINAL #41447 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[neild]

Thanks for the report. I believe this was fixed in go1.24.3, as part of the fix for #73555.

[mknyszek]

I think all that's left to do is wait for confirmation that it is indeed fixed for you, @ghost. Thanks.

[seankhliao]

I suspect we'll never get a confirmation.
ghost is the account used for deleted users.