[PATCH] kobject_uevent: fix OOB read in kobject_action_type()

[PATCH] kobject_uevent: fix OOB read in kobject_action_type()

[Hyeontaek Lim]

kobject_action_type() matches a user-supplied action string against
the short "add"/"remove"/"change"/... literals in kobject_actions[]
using strncmp() with a length (count_first) derived from the size of
the user-supplied buffer (up to the first space, or the whole write).

strncmp() correctly stops comparing as soon as it hits a NUL byte in
either string, so a caller can make it report a "match" against a
short literal like "add" by embedding a NUL right after "add" in an
otherwise much longer buffer (e.g. write "add\0" followed by 391
bytes of arbitrary padding, with no space, so count_first stays at
the full write length).

The subsequent bounds check then indexes the matched literal at that
same, much larger offset:

    if (kobject_actions[action][count_first] != '\0')

which reads far past the end of the 4-byte "add" literal, into
whatever object happens to follow it in .rodata (observed to land
inside uevent_helper_sysctl_table on the reporter's build).

Fix this by checking the literal's real length against count_first
before doing the strncmp()/indexing at all, instead of trusting that
a strncmp() "match" implies the lengths agree.

Reported-by: syzbot+d164947c037324221043@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d164947c037324221043
Signed-off-by: Hyeontaek Lim <jennystr233@gmail.com>
---
 lib/kobject_uevent.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index xxxxxxx..xxxxxxx 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -78,10 +78,11 @@ static int kobject_action_type(const char *buf, size_t count,
 		count_first = count;

 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
+		if (strlen(kobject_actions[action]) != count_first)
+			continue;
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
 			continue;
-		if (kobject_actions[action][count_first] != '\0')
-			continue;
 		if (args)
 			*args = args_start;
 		*type = action;

Re: [PATCH] kobject_uevent: fix OOB read in kobject_action_type()

[Greg Kroah-Hartman]

On Mon, Sep 28, 2026 at 02:42:41AM +0900, Hyeontaek Lim wrote:
> kobject_action_type() matches a user-supplied action string against
> the short "add"/"remove"/"change"/... literals in kobject_actions[]
> using strncmp() with a length (count_first) derived from the size of
> the user-supplied buffer (up to the first space, or the whole write).
> 
> strncmp() correctly stops comparing as soon as it hits a NUL byte in
> either string, so a caller can make it report a "match" against a
> short literal like "add" by embedding a NUL right after "add" in an
> otherwise much longer buffer (e.g. write "add\0" followed by 391
> bytes of arbitrary padding, with no space, so count_first stays at
> the full write length).
> 
> The subsequent bounds check then indexes the matched literal at that
> same, much larger offset:
> 
>     if (kobject_actions[action][count_first] != '\0')
> 
> which reads far past the end of the 4-byte "add" literal, into
> whatever object happens to follow it in .rodata (observed to land
> inside uevent_helper_sysctl_table on the reporter's build).
> 
> Fix this by checking the literal's real length against count_first
> before doing the strncmp()/indexing at all, instead of trusting that
> a strncmp() "match" implies the lengths agree.
> 
> Reported-by: syzbot+d164947c037324221043@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d164947c037324221043
> Signed-off-by: Hyeontaek Lim <jennystr233@gmail.com>
> ---
>  lib/kobject_uevent.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index xxxxxxx..xxxxxxx 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -78,10 +78,11 @@ static int kobject_action_type(const char *buf, size_t count,
>  		count_first = count;
> 
>  	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
> +		if (strlen(kobject_actions[action]) != count_first)
> +			continue;
>  		if (strncmp(kobject_actions[action], buf, count_first) != 0)
>  			continue;
> -		if (kobject_actions[action][count_first] != '\0')
> -			continue;
>  		if (args)
>  			*args = args_start;
>  		*type = action;
> 

Hasn't this been resolved already?