Re: [PATCH] kobject: fix out-of-bounds read in action parser

["Vishal Moola (Fractile)" <vishal.moola@gmail.com>]

I was looking at reviewing your patch. Unfortunately, it doesn't appear
to apply cleanly; I'm seeing:

Applying: kobject: fix out-of-bounds read in action parser
error: corrupt patch at .git/rebase-apply/patch:10
Patch failed at 0001 kobject: fix out-of-bounds read in action parser

It looks like sashiko failed to apply it as well[1]. Perhaps you should
reformat and resend?

On Tue, Aug 18, 2026 at 02:26:14PM +0800, Jiacheng Xu wrote:
> kobject_action_type() uses the position of the first space in the input
> as the length of the uevent action.  It then checks the byte at that
> position in the corresponding action string.
> 
> An embedded NUL byte can make strncmp() report a match while
> count_first is already greater than the actual length of the action
> string.  For example, the input "bind\0 ..." makes the parser access
> kobject_actions[KOBJ_BIND][5], which is beyond the end of the "bind"
> string.
> 
> Use strlen() to verify that the input action length exactly matches the
> known action string before accepting the match.  This avoids indexing
> the action string with an out-of-bounds offset.
> 
> Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
> Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> ---
> lib/kobject_uevent.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> index ddbc4d7482d2..b03562301bfe 100644
> --- a/lib/kobject_uevent.c
> +++ b/lib/kobject_uevent.c
> @@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
> for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
>         if (strncmp(kobject_actions[action], buf, count_first) != 0)
>                 continue;
> -             if (kobject_actions[action][count_first] != '\0')
> +             if (strlen(kobject_actions[action]) != count_first)
>                 continue;
>         if (args)
>                 *args = args_start;

[1] https://sashiko.dev/#/patchset/200d27f7.1471a.1a0138c92da.Coremail.stitch%40zju.edu.cn