github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf symbols: Add bounds checks to elf_read_build_id() note iteration

Browse Source 
elf_read_build_id() iterates ELF notes using pointer arithmetic
driven by n_namesz and n_descsz from the note headers.  Neither
the note header read nor the subsequent name/desc advances are
checked against the section boundary.  A malformed ELF file with
oversized note sizes causes out-of-bounds reads past the section
data buffer.

Add two bounds checks: verify the note header fits within the
remaining section data, and verify that namesz + descsz (after
alignment) fits before advancing the pointer.

Fixes: fd7a346ea2 ("perf symbols: Filename__read_build_id should look at .notes section too")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Arnaldo Carvalho de Melo 2026-06-08 08:12:34 -03:00
parent a0e4362a3e
commit acc56d3941
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
tools/perf/util/symbol-elf.c
View File

@ -835,10 +835,24 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
ptr = data->d_buf;
while (ptr < (data->d_buf + data->d_size)) {
GElf_Nhdr *nhdr = ptr;
size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
descsz = NOTE_ALIGN(nhdr->n_descsz);
size_t namesz, descsz, remaining;
const char *name;
/* ensure the note header fits within the section */
if (ptr + sizeof(*nhdr) > data->d_buf + data->d_size)
break;
namesz = NOTE_ALIGN(nhdr->n_namesz);
descsz = NOTE_ALIGN(nhdr->n_descsz);
/* validate individually to avoid size_t overflow on 32-bit */
remaining = data->d_buf + data->d_size - ptr - sizeof(*nhdr);
if (namesz > remaining || descsz > remaining - namesz) {
pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n",
__func__, nhdr->n_namesz, nhdr->n_descsz);
break;
}
ptr += sizeof(*nhdr);
name = ptr;
ptr += namesz;