Messages in this thread | | | Date | Tue, 7 Mar 2023 17:08:02 +0800 | Subject | Re: [PATCH] kobject: Fix global-out-of-bounds in kobject_action_type() | From | Xia Fukun <> |
| |
Thanks for your reply. Your understanding is correct."offline\0\0\0\0\0\0\0\0\0\0" is indeed blocked from matching "offline" and returns a failed result.
I'm not sure whether to relax the restrictions to make it match successfully. After all, the incoming count is too large and not the actual length of "offline".
在 2023/3/7 16:16, Greg KH 写道: > On Tue, Mar 07, 2023 at 02:37:57PM +0800, Xia Fukun wrote: >> The following c language code can trigger KASAN's global variable >> out-of-bounds access error in kobject_action_type(): >> >> >> diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c >> index 7c44b7ae4c5c..668346bd28fa 100644 >> --- a/lib/kobject_uevent.c >> +++ b/lib/kobject_uevent.c >> @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, >> for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { >> if (strncmp(kobject_actions[action], buf, count_first) != 0) >> continue; >> - if (kobject_actions[action][count_first] != '\0') >> + if (strlen(kobject_actions[action]) != count_first) >> continue; >> if (args) >> *args = args_start; > > Yes, this will stop us from reading a read-only location somewhere in > the kernel outside of the string array, but is it still doing the same > functional logic here? > > In your change, this call to strlen will cause the length check to fail, > so the loop will continue on, and the type will never be set properly. > Is that correct in your testing? You just prevented a string of > "offline\0\0\0\0\0\0\0\0\0\0" from properly being parsed as an offline > event, which I don't think is what you meant to do, right? > > Or am I reading this code incorrectly? It really could be cleaned up, > it's not obvious at all. Parsing strings in C is a mess... > > thanks, > > greg k-h > >
| |