[PATCH v2] kobject: optimize count first value

[Edward Adam Davis]

The user writes to the regular sysfs file "/sys/bus/acpi/uevent\000" is
as follows:

write(r0, &(0x7f0000000280)='add\x00', 0xff0a);

>From the parameters of write, we can know that: buffer is 'add\x00', and
buffer count is 0xff0a.

Since atomic_write_len was 0, kernfs_fop_write_iter() would silently truncate
the buffer count 0xff0a to PAGE_SIZE.

In kobject_action_type(), the strncmp() successfully stops at the null
terminator for "add". Then the code directly attempts to access index 4095
of the 4-byte string literal "add" via kobject_actions[action][count_first],
potentially hitting:

BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
Call Trace:
 kobject_action_type lib/kobject_uevent.c:86 [inline]
 kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
 bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687

When the buffer does not contain parameters, we take the smaller of the
buffer string's actual length and the buffer count provided by the user
as count_first.

Fixes: 5c5daf657cb5 ("Driver core: exclude kobject_uevent.c for !CONFIG_HOTPLUG")
Reported-by: syzbot+9a321aea9d851b299486@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
Tested-by: syzbot+9a321aea9d851b299486@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Edward Adam Davis <eadavis@xxxxxxxx>
---
v1 -> v2: change to optimize kobject

 lib/kobject_uevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..09dbee6d8815 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -78,7 +78,7 @@ static int kobject_action_type(const char *buf, size_t count,
 		count_first = args_start - buf;
 		args_start = args_start + 1;
 	} else
-		count_first = count;
+		count_first = min_t(size_t, strnlen(buf, count), count);
 
 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
-- 
2.43.0