Re: [PATCH] kobject_uevent: fix OOB read in kobject_action_type()

[Greg Kroah-Hartman]

On Mon, Sep 28, 2026 at 02:42:41AM +0900, Hyeontaek Lim wrote:
> kobject_action_type() matches a user-supplied action string against
> the short "add"/"remove"/"change"/... literals in kobject_actions[]
> using strncmp() with a length (count_first) derived from the size of
> the user-supplied buffer (up to the first space, or the whole write).
> 
> strncmp() correctly stops comparing as soon as it hits a NUL byte in
> either string, so a caller can make it report a "match" against a
> short literal like "add" by embedding a NUL right after "add" in an
> otherwise much longer buffer (e.g. write "add\0" followed by 391
> bytes of arbitrary padding, with no space, so count_first stays at
> the full write length).
> 
> The subsequent bounds check then indexes the matched literal at that
> same, much larger offset:
> 
>     if (kobject_actions[action][count_first] != '\0')
> 
> which reads far past the end of the 4-byte "add" literal, into
> whatever object happens to follow it in .rodata (observed to land
> inside uevent_helper_sysctl_table on the reporter's build).
> 
> Fix this by checking the literal's real length against count_first
> before doing the strncmp()/indexing at all, instead of trusting that
> a strncmp() "match" implies the lengths agree.
> 
> Reported-by: syzbot+d164947c037324221043@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=d164947c037324221043
> Signed-off-by: Hyeontaek Lim <jennystr233@xxxxxxxxx>
> ---
>  lib/kobject_uevent.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index xxxxxxx..xxxxxxx 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -78,10 +78,11 @@ static int kobject_action_type(const char *buf, size_t count,
>  		count_first = count;
> 
>  	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
> +		if (strlen(kobject_actions[action]) != count_first)
> +			continue;
>  		if (strncmp(kobject_actions[action], buf, count_first) != 0)
>  			continue;
> -		if (kobject_actions[action][count_first] != '\0')
> -			continue;
>  		if (args)
>  			*args = args_start;
>  		*type = action;
> 

Hasn't this been resolved already?