The user writes to the regular sysfs file "/sys/bus/acpi/uevent\000" is
as follows:

write(r0, &(0x7f0000000280)='add\x00', 0xff0a);

From the parameters of write, we can know that: buffer is 'add\x00', and
buffer count is 0xff0a.

Since atomic_write_len was 0, kernfs_fop_write_iter() would silently truncate
the buffer count 0xff0a to PAGE_SIZE.

In kobject_action_type(), the strncmp() successfully stops at the null
terminator for "add". Then the code directly attempts to access index 4095
of the 4-byte string literal "add" via kobject_actions[action][count_first],
potentially hitting:

BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
Call Trace:
 kobject_action_type lib/kobject_uevent.c:86 [inline]
 kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
 bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x6af/0x1050 fs/read_write.c:687

When the buffer does not contain parameters, we take the smaller of the
buffer string's actual length and the buffer count provided by the user
as count_first.

Fixes: 5c5daf657cb5 ("Driver core: exclude kobject_uevent.c for !CONFIG_HOTPLUG")
Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: change to optimize kobject

 lib/kobject_uevent.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index ddbc4d7482d2..09dbee6d8815 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -78,7 +78,7 @@ static int kobject_action_type(const char *buf, size_t count,
 		count_first = args_start - buf;
 		args_start = args_start + 1;
 	} else
-		count_first = count;
+		count_first = min_t(size_t, strnlen(buf, count), count);
 
 	for (action = 0; action < ARRAY_SIZE(kobject_actions); action++) {
 		if (strncmp(kobject_actions[action], buf, count_first) != 0)
-- 
2.43.0

On Wed, Sep 23, 2026 at 06:55:22PM +0800, Edward Adam Davis wrote:
> The user writes to the regular sysfs file "/sys/bus/acpi/uevent\000" is
> as follows:
> 
> write(r0, &(0x7f0000000280)='add\x00', 0xff0a);

You mean a "root user", right?  So don't do that :)

> >From the parameters of write, we can know that: buffer is 'add\x00', and
> buffer count is 0xff0a.
> 
> Since atomic_write_len was 0, kernfs_fop_write_iter() would silently truncate
> the buffer count 0xff0a to PAGE_SIZE.
> 
> In kobject_action_type(), the strncmp() successfully stops at the null
> terminator for "add". Then the code directly attempts to access index 4095
> of the 4-byte string literal "add" via kobject_actions[action][count_first],
> potentially hitting:
> 
> BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> Call Trace:
>  kobject_action_type lib/kobject_uevent.c:86 [inline]
>  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
>  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
>  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
>  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>  new_sync_write fs/read_write.c:595 [inline]
>  vfs_write+0x6af/0x1050 fs/read_write.c:687
> 
> When the buffer does not contain parameters, we take the smaller of the
> buffer string's actual length and the buffer count provided by the user
> as count_first.
> 
> Fixes: 5c5daf657cb5 ("Driver core: exclude kobject_uevent.c for !CONFIG_HOTPLUG")
> Reported-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9a321aea9d851b299486
> Tested-by: syzbot+9a321aea9d851b299486@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
> v1 -> v2: change to optimize kobject

Hasn't this been submitted before from others?  Have you seen this
thread:
	https://lore.kernel.org/r/200d27f7.1471a.1a0138c92da.Coremail.stitch@zju.edu.cn
?

Your "fix" is different from the above, which is correct?

thanks,

greg k-h