Messages in this thread Patch in this message | | | From | Xia Fukun <> | Subject | [PATCH] kobject: Fix global-out-of-bounds in kobject_action_type() | Date | Tue, 7 Mar 2023 14:37:57 +0800 |
| |
The following c language code can trigger KASAN's global variable out-of-bounds access error in kobject_action_type():
int main() { int fd; char *filename = "/sys/block/ram12/uevent"; char str[86] = "offline"; int len = 0x56;
fd = open(filename, O_WRONLY); if (fd == -1) { printf("open"); exit(1); }
if (write(fd, str, len) == -1) { printf("write"); exit(1); }
close(fd); return 0; }
Function kobject_action_type() receives the input parameters buf and count, where count is the length of the string buf.
In the use case we provided, count is 86, the count_first is 85. Buf points to a string with a length of 86, and its first seven characters are "offline". In line 87 of the code, kobject_actions[action] is the string "offline" with the length of 7,an out-of-boundary access will appear:
kobject_actions[action][85].
Modify the comparison logic to determine whether count_first is equal to the length of string kobject_actions[action]. This can fix the problem.
Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents") Signed-off-by: Xia Fukun <xiafukun@huawei.com> --- lib/kobject_uevent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c index 7c44b7ae4c5c..668346bd28fa 100644 --- a/lib/kobject_uevent.c +++ b/lib/kobject_uevent.c @@ -84,7 +84,7 @@ static int kobject_action_type(const char *buf, size_t count, for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) { if (strncmp(kobject_actions[action], buf, count_first) != 0) continue; - if (kobject_actions[action][count_first] != '\0') + if (strlen(kobject_actions[action]) != count_first) continue; if (args) *args = args_start; -- 2.17.1
| |