Re: [PATCH] sysfs: prevent writing excessively large files

[Edward Adam Davis]

From: Edward Aadm Davis <eadavis@xxxxxxxx>

On Wed, 16 Sep 2026 18:44:06 +0100, Greg KH wrote:
> On Wed, Sep 16, 2026 at 06:19:30PM +0800, Edward Adam Davis wrote:
> > From: Edward Aadm Davis <eadavis@xxxxxxxx>
> >
> > On Wed, 16 Sep 2026 09:17:56 +0200, Greg KH wrote:
> > > > Since atomic_write_len is not configured for sysfs_file_kfops_rw, a large
> > > > file write via sysfs_kf_write() may result in an out-of-bounds read when
> > > > checking for the null terminator of a string element in the kobject_actions
> > > > array within kobject_action_type(), potentially hitting:
> > >
> > > What sysfs file are you hitting this on?
> > Regular sysfs files.
> 
> Which one, all?
/sys/bus/acpi/uevent
> 
> > > > BUG: KASAN: global-out-of-bounds in kobject_action_type lib/kobject_uevent.c:86 [inline]
> > > > BUG: KASAN: global-out-of-bounds in kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > > > Read of size 1 at addr ffffffff8d72559f by task syz.0.17/5917
> > > > Call Trace:
> > > >  kobject_action_type lib/kobject_uevent.c:86 [inline]
> > > >  kobject_synth_uevent+0x79d/0x7d0 lib/kobject_uevent.c:200
> > > >  bus_uevent_store+0x3d/0x90 drivers/base/bus.c:917
> > > >  bus_attr_store+0x74/0xb0 drivers/base/bus.c:172
> > > >  sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> > > >  kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> > > >  new_sync_write fs/read_write.c:595 [inline]
> > > >  vfs_write+0x6af/0x1050 fs/read_write.c:687
> > > >
> > > > Add atomic_write_len for sysfs_file_kfops_rw and sysfs_file_kfops_wo
> > > > properly.
> > > >
> > > > Fixes: f6acf8bb6a40 ("sysfs, kernfs: introduce kernfs_ops")
> > >
> > > What changed to suddenly cause this to show up now if this has been
> > > present for decades?
> > This issue has always existed. It remained undetected simply because the
> > buffer lengths typically passed when writing to `/sys/bus/acpi/uevent`
> > happened to be reasonably appropriate.
> 
> So what changed to cause this to show up now?
Starting from f6acf8bb6a40.

cheers,
Edward