sysfs: prevent writing excessively large files

[PATCH] sysfs: prevent writing excessively large files

Posted by Edward Adam Davis 1 week, 2 days ago

Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
file write via sysfs_kf_write() may result in an out-of-bounds read when
checking for the null terminator of a string element in the kobject_actions
array within kobject_action_type(), potentially hitting:

BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
Call Trace:
 kobject_action_type lib/kobject_uevent.c:86 [inline]
 kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
 bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687

Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
properly.

Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
 fs/sysfs/file.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index cd5bb0f9fee6..a63130d18680 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -228,10 +228,12 @@ static const struct kernfs_ops sysfs_file_kfops_ro = {
 };
 
 static const struct kernfs_ops sysfs_file_kfops_wo = {
+	.atomic_write_len	= PAGE_SIZE,
 	.write		= sysfs_kf_write,
 };
 
 static const struct kernfs_ops sysfs_file_kfops_rw = {
+	.atomic_write_len	= PAGE_SIZE,
 	.seq_show	= sysfs_kf_seq_show,
 	.write		= sysfs_kf_write,
 };
-- 
2.43.0

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by Greg KH 1 week ago

On Tue, Sep 15, 2026 at 08:20:17PM +0800, Edward Adam Davis wrote:
> Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> file write via sysfs_kf_write() may result in an out-of-bounds read when
> checking for the null terminator of a string element in the kobject_actions
> array within kobject_action_type(), potentially hitting:
> 
> BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> Call Trace:
>  kobject_action_type lib/kobject_uevent.c:86 [inline]
>  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
>  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
>  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
>  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>  new_sync_write fs/read_write.c:595 [inline]
>  vfs_write+0x6af/0x1050 fs/read_write.c:687
> 
> Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> properly.
> 
> Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
> Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
>  fs/sysfs/file.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
> index cd5bb0f9fee6..a63130d18680 100644
> --- a/fs/sysfs/file.c
> +++ b/fs/sysfs/file.c
> @@ -228,10 +228,12 @@ static const struct kernfs_ops sysfs_file_kfops_ro = {
>  };
>  
>  static const struct kernfs_ops sysfs_file_kfops_wo = {
> +	.atomic_write_len	= PAGE_SIZE,
>  	.write		= sysfs_kf_write,
>  };
>  
>  static const struct kernfs_ops sysfs_file_kfops_rw = {
> +	.atomic_write_len	= PAGE_SIZE,
>  	.seq_show	= sysfs_kf_seq_show,
>  	.write		= sysfs_kf_write,
>  };
> -- 
> 2.43.0
> 

Are you sure this will not break those sysfs files that want larger page
sizes?  Given the age of this "issue" it's really worrying to me to
change it now...

thanks,

greg k-h

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by David Laight 1 week ago

On Thu, 17 Sep 2026 08:34:46 +0100
Greg KH <gregkh@linuxfoundation.org> wrote:

> On Tue, Sep 15, 2026 at 08:20:17PM +0800, Edward Adam Davis wrote:
> > Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> > file write via sysfs_kf_write() may result in an out-of-bounds read when
> > checking for the null terminator of a string element in the kobject_actions
> > array within kobject_action_type(), potentially hitting:
> > 
> > BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> > BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> > Call Trace:
> >  kobject_action_type lib/kobject_uevent.c:86 [inline]
> >  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> >  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
> >  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
> >  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> >  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> >  new_sync_write fs/read_write.c:595 [inline]
> >  vfs_write+0x6af/0x1050 fs/read_write.c:687
> > 
> > Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> > properly.
> > 
> > Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> > Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
> > Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> > ---
> >  fs/sysfs/file.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
> > index cd5bb0f9fee6..a63130d18680 100644
> > --- a/fs/sysfs/file.c
> > +++ b/fs/sysfs/file.c
> > @@ -228,10 +228,12 @@ static const struct kernfs_ops sysfs_file_kfops_ro = {
> >  };
> >  
> >  static const struct kernfs_ops sysfs_file_kfops_wo = {
> > +	.atomic_write_len	= PAGE_SIZE,
> >  	.write		= sysfs_kf_write,
> >  };
> >  
> >  static const struct kernfs_ops sysfs_file_kfops_rw = {
> > +	.atomic_write_len	= PAGE_SIZE,
> >  	.seq_show	= sysfs_kf_seq_show,
> >  	.write		= sysfs_kf_write,
> >  };
> > -- 
> > 2.43.0
> >   
> 
> Are you sure this will not break those sysfs files that want larger page
> sizes?  Given the age of this "issue" it's really worrying to me to
> change it now...

If you allowed to leave atomic_write_len as zero then the code shouldn't
let an overlong write through (or should truncate it).
So there must be a bug somewhere else.

Do we know the length for the test that failed?

'atomic_write_len' is also badly named - probably historical.
There is no code to loop over the fragments of a long write and (IIRC) the
write offset is always zero.

There is also some (horrid) related code that can reserve a page buffer
(per node) just in case an access is made when kernel memory isn't
available.
(a flag and a single global page would suffice...)

David


> 
> thanks,
> 
> greg k-h
>

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by Edward Adam Davis 1 week ago

From: Edward Aadm Davis <eadavis@sina.com>

On Thu, 17 Sep 2026 08:34:46 +0100, Greg KH wrote:
> > Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> > file write via sysfs_kf_write() may result in an out-of-bounds read when
> > checking for the null terminator of a string element in the kobject_actions
> > array within kobject_action_type(), potentially hitting:
> >
> > BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> > BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> > Call Trace:
> >  kobject_action_type lib/kobject_uevent.c:86 [inline]
> >  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> >  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
> >  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
> >  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> >  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> >  new_sync_write fs/read_write.c:595 [inline]
> >  vfs_write+0x6af/0x1050 fs/read_write.c:687
> >
> > Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> > properly.
> >
> > Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> > Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
> > Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> > Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> > ---
> >  fs/sysfs/file.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
> > index cd5bb0f9fee6..a63130d18680 100644
> > --- a/fs/sysfs/file.c
> > +++ b/fs/sysfs/file.c
> > @@ -228,10 +228,12 @@ static const struct kernfs_ops sysfs_file_kfops_ro = {
> >  };
> >
> >  static const struct kernfs_ops sysfs_file_kfops_wo = {
> > +	.atomic_write_len	= PAGE_SIZE,
> >  	.write		= sysfs_kf_write,
> >  };
> >
> >  static const struct kernfs_ops sysfs_file_kfops_rw = {
> > +	.atomic_write_len	= PAGE_SIZE,
> >  	.seq_show	= sysfs_kf_seq_show,
> >  	.write		= sysfs_kf_write,
> >  };
> > --
> > 2.43.0
> >
> 
> Are you sure this will not break those sysfs files that want larger page
> sizes?  Given the age of this "issue" it's really worrying to me to
> change it now...
Perhaps it would be better to make a decision after delving deeper into
the details.

cheers,
Edward

[PATCH v2] kobject: optimize count first value

Posted by Edward Adam Davis 1 day, 19 hours ago

The user writes to the regular sysfs file "/sys/bus/acpi/uevent\000" is
as follows:

write(r0, &(0x7f0000000280)='add\x00', 0xff0a);

From the parameters of write, we can know that: buffer is 'add\x00', and
buffer count is 0xff0a.

Since atomic_write_len was 0, kernfs_fop_write_iter() would silently truncate
the buffer count 0xff0a to PAGE_SIZE.

In kobject_action_type(), the strncmp() successfully stops at the null
terminator for "add". Then the code directly attempts to access index 4095
of the 4-byte string literal "add" via kobject_actions[action][count_first],
potentially hitting:

BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
Call Trace:
 kobject_action_type lib/kobject_uevent.c:86 [inline]
 kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
 bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687

When the buffer does not contain parameters, we take the smaller of the
buffer string's actual length and the buffer count provided by the user
as count_first.

Fixes: 5c5daf657cb5 ("Driver core: exclude kobject_uevent.c for !CONFIG_HOTPLUG")
Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: change to optimize kobject

 lib/kobject_uevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..09dbee6d8815 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -78,7 +78,7 @@ static int kobject_action_type(const char *buf, size_t count,
 		count_first = args_start - buf;
 		args_start = args_start + 1;
 	} else
-		count_first = count;
+		count_first = min_t(size_t, strnlen(buf, count), count);
 
 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
-- 
2.43.0

Re: [PATCH v2] kobject: optimize count first value

Posted by Greg KH 1 day, 18 hours ago

On Wed, Sep 23, 2026 at 06:55:22PM +0800, Edward Adam Davis wrote:
> The user writes to the regular sysfs file "/sys/bus/acpi/uevent\000" is
> as follows:
> 
> write(r0, &(0x7f0000000280)='add\x00', 0xff0a);

You mean a "root user", right?  So don't do that :)

> >From the parameters of write, we can know that: buffer is 'add\x00', and
> buffer count is 0xff0a.
> 
> Since atomic_write_len was 0, kernfs_fop_write_iter() would silently truncate
> the buffer count 0xff0a to PAGE_SIZE.
> 
> In kobject_action_type(), the strncmp() successfully stops at the null
> terminator for "add". Then the code directly attempts to access index 4095
> of the 4-byte string literal "add" via kobject_actions[action][count_first],
> potentially hitting:
> 
> BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> Call Trace:
>  kobject_action_type lib/kobject_uevent.c:86 [inline]
>  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
>  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
>  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
>  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>  new_sync_write fs/read_write.c:595 [inline]
>  vfs_write+0x6af/0x1050 fs/read_write.c:687
> 
> When the buffer does not contain parameters, we take the smaller of the
> buffer string's actual length and the buffer count provided by the user
> as count_first.
> 
> Fixes: 5c5daf657cb5 ("Driver core: exclude kobject_uevent.c for !CONFIG_HOTPLUG")
> Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
> Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
> v1 -> v2: change to optimize kobject

Hasn't this been submitted before from others?  Have you seen this
thread:
	https://lore.kernel.org/r/200d27f7.1471a.1a0138c92da.Coremail.stitch@zju.edu.cn
?

Your "fix" is different from the above, which is correct?

thanks,

greg k-h

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by Greg KH 1 week, 1 day ago

On Tue, Sep 15, 2026 at 08:20:17PM +0800, Edward Adam Davis wrote:
> Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> file write via sysfs_kf_write() may result in an out-of-bounds read when
> checking for the null terminator of a string element in the kobject_actions
> array within kobject_action_type(), potentially hitting:

What sysfs file are you hitting this on?

> 
> BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> Call Trace:
>  kobject_action_type lib/kobject_uevent.c:86 [inline]
>  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
>  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
>  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
>  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>  new_sync_write fs/read_write.c:595 [inline]
>  vfs_write+0x6af/0x1050 fs/read_write.c:687
> 
> Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> properly.
> 
> Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")

What changed to suddenly cause this to show up now if this has been
present for decades?

thanks,

greg k-h

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by Edward Adam Davis 1 week, 1 day ago

From: Edward Aadm Davis <eadavis@sina.com>

On Wed, 16 Sep 2026 09:17:56 +0200, Greg KH wrote:
> > Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> > file write via sysfs_kf_write() may result in an out-of-bounds read when
> > checking for the null terminator of a string element in the kobject_actions
> > array within kobject_action_type(), potentially hitting:
> 
> What sysfs file are you hitting this on?
Regular sysfs files.
> 
> >
> > BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> > BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> > Call Trace:
> >  kobject_action_type lib/kobject_uevent.c:86 [inline]
> >  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> >  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
> >  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
> >  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> >  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> >  new_sync_write fs/read_write.c:595 [inline]
> >  vfs_write+0x6af/0x1050 fs/read_write.c:687
> >
> > Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> > properly.
> >
> > Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> 
> What changed to suddenly cause this to show up now if this has been
> present for decades?
This issue has always existed. It remained undetected simply because the
buffer lengths typically passed when writing to `/sys/bus/acpi/uevent`
happened to be reasonably appropriate.

cheers,
Edward

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by Greg KH 1 week, 1 day ago

On Wed, Sep 16, 2026 at 06:19:30PM +0800, Edward Adam Davis wrote:
> From: Edward Aadm Davis <eadavis@sina.com>
> 
> On Wed, 16 Sep 2026 09:17:56 +0200, Greg KH wrote:
> > > Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> > > file write via sysfs_kf_write() may result in an out-of-bounds read when
> > > checking for the null terminator of a string element in the kobject_actions
> > > array within kobject_action_type(), potentially hitting:
> > 
> > What sysfs file are you hitting this on?
> Regular sysfs files.

Which one, all?

> > > BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> > > BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > > Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> > > Call Trace:
> > >  kobject_action_type lib/kobject_uevent.c:86 [inline]
> > >  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > >  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
> > >  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
> > >  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> > >  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> > >  new_sync_write fs/read_write.c:595 [inline]
> > >  vfs_write+0x6af/0x1050 fs/read_write.c:687
> > >
> > > Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> > > properly.
> > >
> > > Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> > 
> > What changed to suddenly cause this to show up now if this has been
> > present for decades?
> This issue has always existed. It remained undetected simply because the
> buffer lengths typically passed when writing to `/sys/bus/acpi/uevent`
> happened to be reasonably appropriate.

So what changed to cause this to show up now?

thanks,

greg k-h

Re: [PATCH] sysfs: prevent writing excessively large files

Posted by Edward Adam Davis 1 week, 1 day ago

From: Edward Aadm Davis <eadavis@sina.com>

On Wed, 16 Sep 2026 18:44:06 +0100, Greg KH wrote:
> On Wed, Sep 16, 2026 at 06:19:30PM +0800, Edward Adam Davis wrote:
> > From: Edward Aadm Davis <eadavis@sina.com>
> >
> > On Wed, 16 Sep 2026 09:17:56 +0200, Greg KH wrote:
> > > > Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> > > > file write via sysfs_kf_write() may result in an out-of-bounds read when
> > > > checking for the null terminator of a string element in the kobject_actions
> > > > array within kobject_action_type(), potentially hitting:
> > >
> > > What sysfs file are you hitting this on?
> > Regular sysfs files.
> 
> Which one, all?
/sys/bus/acpi/uevent
> 
> > > > BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> > > > BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > > > Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> > > > Call Trace:
> > > >  kobject_action_type lib/kobject_uevent.c:86 [inline]
> > > >  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > > >  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
> > > >  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
> > > >  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> > > >  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> > > >  new_sync_write fs/read_write.c:595 [inline]
> > > >  vfs_write+0x6af/0x1050 fs/read_write.c:687
> > > >
> > > > Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> > > > properly.
> > > >
> > > > Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> > >
> > > What changed to suddenly cause this to show up now if this has been
> > > present for decades?
> > This issue has always existed. It remained undetected simply because the
> > buffer lengths typically passed when writing to `/sys/bus/acpi/uevent`
> > happened to be reasonably appropriate.
> 
> So what changed to cause this to show up now?
Starting from f6acf8bb6a40.

cheers,
Edward