[pseudo] [PATCH v2] pseudo_client: Fix xattr/rename handling with empty paths

[pseudo] [PATCH v2] pseudo_client: Fix xattr/rename handling with empty paths

[Richard Purdie]

On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
but path is of zero length. The path_extra_1 codepath does not handle this well and
corrupts memory.

The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
hence strip_slash is also 0). This leads to invalid memory writes and if those
happen to access off the end of a mapped segment, the program segfaults.

Fix the code to handle the pathlen=0 case.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 pseudo_client.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/pseudo_client.c b/pseudo_client.c
index d83175e..1c742ba 100644
--- a/pseudo_client.c
+++ b/pseudo_client.c
@@ -1791,7 +1791,11 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
 	 */
 	if (path_extra_1) {
 		size_t full_len = path_extra_1len + 1 + pathlen - strip_slash;
-		size_t partial_len = pathlen - 1 - strip_slash;
+		size_t partial_len = pathlen - strip_slash;
+		if (!pathlen) {
+			full_len += 1;
+			partial_len = 1;
+		}
 		if (path_extra_2) {
 			full_len += path_extra_2len + 1;
 		}
@@ -1806,12 +1810,14 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
 				return 0;
 			}
 		}
-		memcpy(alloced_path, path, partial_len);
-		alloced_path[partial_len] = '\0';
-		memcpy(alloced_path + partial_len + 1, path_extra_1, path_extra_1len);
-		alloced_path[partial_len + path_extra_1len + 1] = '\0';
+		if (pathlen) {
+			memcpy(alloced_path, path, partial_len - 1);
+		{
+		alloced_path[partial_len - 1] = '\0';
+		memcpy(alloced_path + partial_len, path_extra_1, path_extra_1len);
+		alloced_path[partial_len + path_extra_1len] = '\0';
 		if (path_extra_2) {
-			memcpy(alloced_path + partial_len + path_extra_1len + 2, path_extra_2, path_extra_2len);
+			memcpy(alloced_path + partial_len + path_extra_1len + 1, path_extra_2, path_extra_2len);
 		}
 		alloced_path[full_len - 1] = '\0';
 		path = alloced_path;

Re: [yocto-patches] [pseudo] [PATCH v2] pseudo_client: Fix xattr/rename handling with empty paths

[Mathieu Dubois-Briand]

On Fri Oct 16, 2026 at 12:02 AM CEST, Richard Purdie via lists.yoctoproject.org wrote:
> On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
> but path is of zero length. The path_extra_1 codepath does not handle this well and
> corrupts memory.
>
> The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
> hence strip_slash is also 0). This leads to invalid memory writes and if those
> happen to access off the end of a mapped segment, the program segfaults.
>
> Fix the code to handle the pathlen=0 case.
>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> ---
>  pseudo_client.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
>
> diff --git a/pseudo_client.c b/pseudo_client.c
> index d83175e..1c742ba 100644
> --- a/pseudo_client.c
> +++ b/pseudo_client.c
> ...
> @@ -1806,12 +1810,14 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
>  				return 0;
>  			}
>  		}
> -		memcpy(alloced_path, path, partial_len);
> -		alloced_path[partial_len] = '\0';
> -		memcpy(alloced_path + partial_len + 1, path_extra_1, path_extra_1len);
> -		alloced_path[partial_len + path_extra_1len + 1] = '\0';
> +		if (pathlen) {
> +			memcpy(alloced_path, path, partial_len - 1);
> +		{

Typo :)

But aside of that, I believe it's OK now.

Thanks,
Mathieu


-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

Re: [yocto-patches] [pseudo] [PATCH v2] pseudo_client: Fix xattr/rename handling with empty paths

[Richard Purdie]

On Fri, 2026-10-16 at 08:12 +0200, Mathieu Dubois-Briand via lists.yoctoproject.org wrote:
> On Fri Oct 16, 2026 at 12:02 AM CEST, Richard Purdie via lists.yoctoproject.org wrote:
> > On Fedora45, we can end up in a situation where path_extra_1 (for xattr/rename ops)
> > but path is of zero length. The path_extra_1 codepath does not handle this well and
> > corrupts memory.
> > 
> > The issue is "partial_len = pathlen - 1 - strip_slash" when pathlen is 0 (and
> > hence strip_slash is also 0). This leads to invalid memory writes and if those
> > happen to access off the end of a mapped segment, the program segfaults.
> > 
> > Fix the code to handle the pathlen=0 case.
> > 
> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> > ---
> >  pseudo_client.c | 18 ++++++++++++------
> >  1 file changed, 12 insertions(+), 6 deletions(-)
> > 
> > diff --git a/pseudo_client.c b/pseudo_client.c
> > index d83175e..1c742ba 100644
> > --- a/pseudo_client.c
> > +++ b/pseudo_client.c
> > ...
> > @@ -1806,12 +1810,14 @@ pseudo_client_op(pseudo_op_t op, int access, int fd, int dirfd, const char *path
> >  				return 0;
> >  			}
> >  		}
> > -		memcpy(alloced_path, path, partial_len);
> > -		alloced_path[partial_len] = '\0';
> > -		memcpy(alloced_path + partial_len + 1, path_extra_1, path_extra_1len);
> > -		alloced_path[partial_len + path_extra_1len + 1] = '\0';
> > +		if (pathlen) {
> > +			memcpy(alloced_path, path, partial_len - 1);
> > +		{
> 
> Typo :)

I wondered if anyone would notice :)

> But aside of that, I believe it's OK now.

Thanks, it did pass testing too so I think it should be good.

Cheers,

Richard