Re: [yocto-patches] [pseudo] [PATCH] pseudo_client: Fix xattr/rename handling with empty paths

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Wed, 2026-10-14 at 20:38 +0100, Richard Purdie via lists.yoctoproject.org wrote:
> On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
> but path is of zero length. The path_extra_1 codepath does not handle this well and
> corrupts memory.
> 
> The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
> hence strip_slash is also 0). This leads to invalid memory writes and if those
> happen to access off the end of a mapped segment, the program segfaults.
> 
> Fix the code to handle the pathlen=0 case.
> 
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
>  pseudo_client.c | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)

I had wondered why we had something with a file descriptor which has no
path, I was worried we were not tracking some kind of fd creation we
should be.

The answer is it is a unix domain socket. It therefore does have a path
we could track but we'd not be able to do much with it anyway so it
doesn't really matter.

The reproducer is therefore calling fgetxattr() on a domain socket
which glibc does for nameserver type operations.

Cheers,

Richard