github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf symbols: Add bounds checks to read_build_id() note iteration in minimal build

Browse Source 
symbol-minimal.c's read_build_id() iterates ELF notes with the same
pattern as symbol-elf.c's elf_read_build_id(): pointer arithmetic
driven by n_namesz and n_descsz from 32-bit note header fields,
without validating that the name and desc fit within the note section
data.  A malformed ELF file with oversized note sizes causes
out-of-bounds reads past the section data buffer.

Add the same bounds check as the libelf path: validate namesz and
descsz individually against remaining data before advancing the
pointer, avoiding size_t overflow on 32-bit.

Fixes: b691f64360 ("perf symbols: Implement poor man's ELF parser")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Arnaldo Carvalho de Melo 2026-06-10 16:09:45 -03:00
parent acc56d3941
commit 52e582e316
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
tools/perf/util/symbol-minimal.c
View File

@ -1,3 +1,4 @@
#include "debug.h"
#include "dso.h"
#include "symbol.h"
#include "symsrc.h"
@ -44,7 +45,7 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid,
ptr = note_data;
while ((ptr + sizeof(*nhdr)) < (note_data + note_len)) {
const char *name;
size_t namesz, descsz;
size_t namesz, descsz, remaining;
nhdr = ptr;
if (need_swap) {
@ -56,6 +57,14 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid,
namesz = NOTE_ALIGN(nhdr->n_namesz);
descsz = NOTE_ALIGN(nhdr->n_descsz);
/* validate individually to avoid size_t overflow on 32-bit */
remaining = note_data + note_len - ptr - sizeof(*nhdr);
if (namesz > remaining || descsz > remaining - namesz) {
pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n",
__func__, nhdr->n_namesz, nhdr->n_descsz);
break;
}
ptr += sizeof(*nhdr);
name = ptr;
ptr += namesz;