[PATCH v2 RESEND] kobject: fix out-of-bounds access in kobject_action_type()

[Jiacheng Xu <stitch@zju.edu.cn>]

kobject_action_type() uses the position of the first space in the input
as the length of the uevent action. It then checks the byte at that
position in the corresponding action string.

An embedded NUL byte can make strncmp() report a match while
count_first is already greater than the actual length of the action
string. For example, the input "bind\0 ..." makes the parser access
kobject_actions[KOBJ_BIND][5], which is beyond the end of the "bind"
string.

Use strlen() to verify that the input action length exactly matches the
known action string before accepting the match. This avoids indexing
the action string with an out-of-bounds offset.

Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
Signed-off-by: Jiacheng Xu <stitch@zju.edu.cn>
---
 lib/kobject_uevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..b03562301bfe 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -83,7 +83,7 @@ static int kobject_action_type(const char *buf, size_t count,
 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
 			continue;
-		if (kobject_actions[action][count_first] != '\0')
+		if (strlen(kobject_actions[action]) != count_first)
 			continue;
 		if (args)
 			*args = args_start;
-- 
2.51.0