Re: Re: [PATCH] kobject: fix out-of-bounds read in action parser

["Jiacheng Xu" <stitch@zju.edu.cn>]

Thanks for pointing this out. I'll reformat and resend the patch as v2. Sorry for the noise.

> -----原始邮件-----
> 发件人: "Vishal Moola (Fractile)" <vishal.moola@gmail.com>
> 发送时间:2026-08-25 01:32:54 (星期二)
> 收件人: "Jiacheng Xu" <stitch@zju.edu.cn>
> 抄送: gregkh@linuxfoundation.org, rafael@kernel.org, dakr@kernel.org, akpm@linux-foundation.org, driver-core@lists.linux.dev
> 主题: Re: [PATCH] kobject: fix out-of-bounds read in action parser
> 
> I was looking at reviewing your patch. Unfortunately, it doesn't appear
> to apply cleanly; I'm seeing:
> 
> Applying: kobject: fix out-of-bounds read in action parser
> error: corrupt patch at .git/rebase-apply/patch:10
> Patch failed at 0001 kobject: fix out-of-bounds read in action parser
> 
> It looks like sashiko failed to apply it as well[1]. Perhaps you should
> reformat and resend?
> 
> On Tue, Aug 18, 2026 at 02:26:14PM +0800, Jiacheng Xu wrote:
> > kobject_action_type() uses the position of the first space in the input
> > as the length of the uevent action.  It then checks the byte at that
> > position in the corresponding action string.
> > 
> > An embedded NUL byte can make strncmp() report a match while
> > count_first is already greater than the actual length of the action
> > string.  For example, the input "bind\0 ..." makes the parser access
> > kobject_actions[KOBJ_BIND][5], which is beyond the end of the "bind"
> > string.
> > 
> > Use strlen() to verify that the input action length exactly matches the
> > known action string before accepting the match.  This avoids indexing
> > the action string with an out-of-bounds offset.
> > 
> > Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
> > Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
> > ---
> > lib/kobject_uevent.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
> > index ddbc4d7482d2..b03562301bfe 100644
> > --- a/lib/kobject_uevent.c
> > +++ b/lib/kobject_uevent.c
> > @@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
> > for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
> >         if (strncmp(kobject_actions[action], buf, count_first) != 0)
> >                 continue;
> > -             if (kobject_actions[action][count_first] != '\0')
> > +             if (strlen(kobject_actions[action]) != count_first)
> >                 continue;
> >         if (args)
> >                 *args = args_start;
> 
> [1] https://sashiko.dev/#/patchset/200d27f7.1471a.1a0138c92da.Coremail.stitch%40zju.edu.cn