Re: [yocto-patches] [pseudo] [PATCH] pseudo_client: Fix xattr/rename handling with empty paths

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Wed Oct 14, 2026 at 9:38 PM CEST, Richard Purdie via lists.yoctoproject.org wrote:
> On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
> but path is of zero length. The path_extra_1 codepath does not handle this well and
> corrupts memory.
>
> The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
> hence strip_slash is also 0). This leads to invalid memory writes and if those
> happen to access off the end of a mapped segment, the program segfaults.
>
> Fix the code to handle the pathlen=0 case.
>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
>  pseudo_client.c | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/pseudo_client.c b/pseudo_client.c
> index 23d7b0f..002de30 100644
> --- a/pseudo_client.c
> +++ b/pseudo_client.c
> @@ -1789,7 +1789,7 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
>  	 */
>  	if (path_extra_1) {
>  		size_t full_len = path_extra_1len + 1 + pathlen - strip_slash;
> -		size_t partial_len = pathlen - 1 - strip_slash;
> +		size_t partial_len = pathlen - strip_slash;
>  		if (path_extra_2) {
>  			full_len += path_extra_2len + 1;
>  		}
> @@ -1804,12 +1804,17 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
>  				return 0;
>  			}
>  		}
> -		memcpy(alloced_path, path, partial_len);
> -		alloced_path[partial_len] = '\0';
> -		memcpy(alloced_path + partial_len + 1, path_extra_1, path_extra_1len);
> -		alloced_path[partial_len + path_extra_1len + 1] = '\0';
> +		if (pathlen) {
> +			memcpy(alloced_path, path, partial_len - 1);
> +			alloced_path[partial_len - 1] = '\0';
> +		} else {
> +			alloced_path[0] = '\0';
> +			partial_len = 1;

Err, I have a doubt here.

Setting partial_len to 1 looks correct, but it was previously used to
compute full_len, that is used to check the if buffer is big enough
(full_len > alloced_len).

So if pathlen is 0, the buffer can be 1 byte too short, right? Just
incrementing partial_len a bit before should fix that.

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com