Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <24c413e6-75a5-254c-b776-1459da83f86f@redhat.com>
Date:   Tue, 16 May 2023 16:02:26 +0200
MIME-Version: 1.0
Content-Language: en-MW
To:     Xia Fukun <xiafukun@huawei.com>
Cc:     linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org
References: <20230516123719.117137-1-xiafukun@huawei.com>
From:   Peter Rajnoha <prajnoha@redhat.com>
Subject: Re: [PATCH v5] kobject: Fix global-out-of-bounds in
 kobject_action_type()
In-Reply-To: <20230516123719.117137-1-xiafukun@huawei.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 5/16/23 14:37, Xia Fukun wrote:
> The following c language code can trigger KASAN's global variable
> out-of-bounds access error in kobject_action_type():
> 
> int main() {
>     int fd;
>     char *filename = "/sys/block/ram12/uevent";
>     char str[86] = "offline";
>     int len = 86;
> 
>     fd = open(filename, O_WRONLY);
>     if (fd == -1) {
>         printf("open");
>         exit(1);
>     }
> 
>     if (write(fd, str, len) == -1) {
>         printf("write");
>         exit(1);
>     }
> 
>     close(fd);
>     return 0;
> }
> 
> Function kobject_action_type() receives the input parameters buf and count,
> where count is the length of the string buf.
> 
> In the use case we provided, count is 86, the count_first is 85.
> Buf points to a string with a length of 86, and its first seven
> characters are "offline".
> In line 87 of the code, kobject_actions[action] is the string "offline"
> with the length of 7,an out-of-boundary access will appear:
> 
> kobject_actions[action][85].
> 
> Use sysfs_match_string() to replace the fragile and convoluted loop.
> This function is well-tested for parsing sysfs inputs. Moreover, this
> modification will not cause any functional changes.
> 
> Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
> Signed-off-by: Xia Fukun <xiafukun@huawei.com>
> ---
> v4 -> v5:
> - Fixed build errors and warnings, and retested the patch.
> 

Please, also check this is still working:
https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-uevent

When I try passing the example line "add
fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc", it doesn't recognize
such input anymore and it incorrectly considers it as erroneous.

-- 
Peter