Re: [PATCH v2] kobject: Fix global-out-of-bounds in kobject_action_type()

Greg KH
2023-03-09T11:08:09Z

On Wed, Mar 08, 2023 at 11:59:30AM +0800, Xia Fukun wrote:
> The following c language code can trigger KASAN's global variable
> out-of-bounds access error in kobject_action_type():
>
> int main() {
> int fd;
> char *filename = "/sys/block/ram12/uevent";
> char str[86] = "offline";
> int len = 86;
>
> fd = open(filename, O_WRONLY);
> if (fd == -1) {
> printf("open");
> exit(1);
> }
>
> if (write(fd, str, len) == -1) {
> printf("write");
> exit(1);
> }
>
> close(fd);
> return 0;
> }
>
> Function kobject_action_type() receives the input parameters buf and count,
> where count is the length of the string buf.
>
> In the use case we provided, count is 86, the count_first is 85.
> Buf points to a string with a length of 86, and its first seven
> characters are "offline".
> In line 87 of the code, kobject_actions[action] is the string "offline"
> with the length of 7,an out-of-boundary access will appear:
>
> kobject_actions[action][85].
>
> Modify the judgment logic in line 87. If the length of the string
> kobject_actions[action] is greater than count_first(e.g. buf is "off",
> count is 3), continue the loop.
> Otherwise, the match is considered successful.
>
> This change means that our test case will be successfully parsed as an
> offline event and no out-of-bounds access error will occur.
>
> Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
> Signed-off-by: Xia Fukun <xiafukun@huawei.com>
> ---
> v1 -> v2:
> - modify the matching logic

I see 2 v2 patches in my queue, with no way to tell which one is
correct.

Please fix up and send a v3.

thanks,

greg k-h