Re: [PATCH v2] kobject: optimize count first value

[Greg KH]

On Wed, Sep 23, 2026 at 06:55:22PM +0800, Edward Adam Davis wrote:
> The user writes to the regular sysfs file "/sys/bus/acpi/uevent\000" is
> as follows:
> 
> write(r0, &(0x7f0000000280)='add\x00', 0xff0a);

You mean a "root user", right?  So don't do that :)

> >From the parameters of write, we can know that: buffer is 'add\x00', and
> buffer count is 0xff0a.
> 
> Since atomic_write_len was 0, kernfs_fop_write_iter() would silently truncate
> the buffer count 0xff0a to PAGE_SIZE.
> 
> In kobject_action_type(), the strncmp() successfully stops at the null
> terminator for "add". Then the code directly attempts to access index 4095
> of the 4-byte string literal "add" via kobject_actions[action][count_first],
> potentially hitting:
> 
> BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> Call Trace:
>  kobject_action_type lib/kobject_uevent.c:86 [inline]
>  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
>  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
>  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
>  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>  new_sync_write fs/read_write.c:595 [inline]
>  vfs_write+0x6af/0x1050 fs/read_write.c:687
> 
> When the buffer does not contain parameters, we take the smaller of the
> buffer string's actual length and the buffer count provided by the user
> as count_first.
> 
> Fixes: 5c5daf657cb5 ("Driver core: exclude kobject_uevent.c for !CONFIG_HOTPLUG")
> Reported-by: syzbot+9a321aea9d851b299486@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
> Tested-by: syzbot+9a321aea9d851b299486@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Edward Adam Davis <eadavis@xxxxxxxx>
> ---
> v1 -> v2: change to optimize kobject

Hasn't this been submitted before from others?  Have you seen this
thread:
	https://lore.kernel.org/r/200d27f7.1471a.1a0138c92da.Coremail.stitch@xxxxxxxxxx
?

Your "fix" is different from the above, which is correct?

thanks,

greg k-h