Re: [PATCH v2 RESEND] kobject: fix out-of-bounds access in kobject_action_type()

["Vishal Moola (Fractile)" <vishal.moola@gmail.com>]

On Tue, Aug 25, 2026 at 03:05:25PM +0800, Jiacheng Xu wrote:
> kobject_action_type() uses the position of the first space in the input
> as the length of the uevent action. It then checks the byte at that
> position in the corresponding action string.
> 
> An embedded NUL byte can make strncmp() report a match while
> count_first is already greater than the actual length of the action
> string. For example, the input "bind\0 ..." makes the parser access
> kobject_actions[KOBJ_BIND][5], which is beyond the end of the "bind"
> string.
> 
> Use strlen() to verify that the input action length exactly matches the
> known action string before accepting the match. This avoids indexing
> the action string with an out-of-bounds offset.

Sounds sensible to me. This doesn't seem like something anyone should
intentionally be doing, and I assume users won't care about the additional
minor overhead of strlen().

From what I can tell, this does change the behavior for actions with Nul
embedded strings from 'undefined' to 'expected to fail.' I think that's worth
mentioning in the commit log.

> Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")

Also, it appears the pattern predates this commit, so definitely double
check that tag :)

> Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>

With those mentioned, feel free to add my tag:

Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>

> ---
>  lib/kobject_uevent.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index ddbc4d7482d2..b03562301bfe 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
>  	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
>  		if (strncmp(kobject_actions[action], buf, count_first) != 0)
>  			continue;
> -		if (kobject_actions[action][count_first] != '\0')
> +		if (strlen(kobject_actions[action]) != count_first)
>  			continue;
>  		if (args)
>  			*args = args_start;
> -- 
> 2.51.0
>