[v5] kobject: Fix global-out-of-bounds in kobject_action_type()

  The following c language code can trigger KASAN's global variable
out-of-bounds access error in kobject_action_type():

int main() {
    int fd;
    char *filename = "/sys/block/ram12/uevent";
    char str[86] = "offline";
    int len = 86;

    fd = open(filename, O_WRONLY);
    if (fd == -1) {
        printf("open");
        exit(1);
    }

    if (write(fd, str, len) == -1) {
        printf("write");
        exit(1);
    }

    close(fd);
    return 0;
}

Function kobject_action_type() receives the input parameters buf and count,
where count is the length of the string buf.

In the use case we provided, count is 86, the count_first is 85.
Buf points to a string with a length of 86, and its first seven
characters are "offline".
In line 87 of the code, kobject_actions[action] is the string "offline"
with the length of 7,an out-of-boundary access will appear:

kobject_actions[action][85].

Use sysfs_match_string() to replace the fragile and convoluted loop.
This function is well-tested for parsing sysfs inputs. Moreover, this
modification will not cause any functional changes.

Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
Signed-off-by: Xia Fukun <xiafukun@huawei.com>
---
v4 -> v5:
- Fixed build errors and warnings, and retested the patch.

v3 -> v4:
- Refactor the function to be more obviously correct and readable.
---
 lib/kobject_uevent.c | 32 +++++++++++++++-----------------
 1 file changed, 15 insertions(+), 17 deletions(-)
  

On 5/16/23 14:37, Xia Fukun wrote:
> The following c language code can trigger KASAN's global variable
> out-of-bounds access error in kobject_action_type():
> 
> int main() {
>     int fd;
>     char *filename = "/sys/block/ram12/uevent";
>     char str[86] = "offline";
>     int len = 86;
> 
>     fd = open(filename, O_WRONLY);
>     if (fd == -1) {
>         printf("open");
>         exit(1);
>     }
> 
>     if (write(fd, str, len) == -1) {
>         printf("write");
>         exit(1);
>     }
> 
>     close(fd);
>     return 0;
> }
> 
> Function kobject_action_type() receives the input parameters buf and count,
> where count is the length of the string buf.
> 
> In the use case we provided, count is 86, the count_first is 85.
> Buf points to a string with a length of 86, and its first seven
> characters are "offline".
> In line 87 of the code, kobject_actions[action] is the string "offline"
> with the length of 7,an out-of-boundary access will appear:
> 
> kobject_actions[action][85].
> 
> Use sysfs_match_string() to replace the fragile and convoluted loop.
> This function is well-tested for parsing sysfs inputs. Moreover, this
> modification will not cause any functional changes.
> 
> Fixes: f36776fafbaa ("kobject: support passing in variables for synthetic uevents")
> Signed-off-by: Xia Fukun <xiafukun@huawei.com>
> ---
> v4 -> v5:
> - Fixed build errors and warnings, and retested the patch.
> 

Please, also check this is still working:
https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-uevent

When I try passing the example line "add
fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc", it doesn't recognize
such input anymore and it incorrectly considers it as erroneous.
  

在 2023/5/16 22:02, Peter Rajnoha wrote:
> On 5/16/23 14:37, Xia Fukun wrote:

>> ---
>> v4 -> v5:
>> - Fixed build errors and warnings, and retested the patch.
>>
> 
> Please, also check this is still working:
> https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-uevent
> 
> When I try passing the example line "add
> fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc", it doesn't recognize
> such input anymore and it incorrectly considers it as erroneous.
> 

Why did I receive the following error message when passing the example
line "add fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc" using the
original mainline code?

synth uevent: /devices/virtual/block/ram12: incorrect uevent action arguments
block ram12: uevent: failed to send synthetic uevent: -22

Is there a problem with my test case, or is the original code unable
to successfully parse the sample?
  

On 5/17/23 10:54, Xia Fukun wrote:
> 在 2023/5/16 22:02, Peter Rajnoha wrote:
>> On 5/16/23 14:37, Xia Fukun wrote:
> 
>>> ---
>>> v4 -> v5:
>>> - Fixed build errors and warnings, and retested the patch.
>>>
>>
>> Please, also check this is still working:
>> https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-uevent
>>
>> When I try passing the example line "add
>> fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc", it doesn't recognize
>> such input anymore and it incorrectly considers it as erroneous.
>>
> 
> Why did I receive the following error message when passing the example
> line "add fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc" using the
> original mainline code?
> 
> synth uevent: /devices/virtual/block/ram12: incorrect uevent action arguments
> block ram12: uevent: failed to send synthetic uevent: -22
> 
> Is there a problem with my test case, or is the original code unable
> to successfully parse the sample?
> 

That works for me, I'm testing on kernel 6.2.15:

# echo "add fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed A=1 B=abc" >
/sys/block/ram0/uevent

# udevadm monitor --kernel --env
monitor will print the received events for:
KERNEL - the kernel uevent

KERNEL[189.376386] add      /devices/virtual/block/ram0 (block)
ACTION=add
DEVPATH=/devices/virtual/block/ram0
SUBSYSTEM=block
SYNTH_UUID=fe4d7c9d-b8c6-4a70-9ef1-3d8a58d18eed
SYNTH_ARG_A=1
SYNTH_ARG_B=abc
DEVNAME=/dev/ram0
DEVTYPE=disk
DISKSEQ=14
SEQNUM=3781
MAJOR=1
MINOR=0