linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run
@ 2020-02-10 16:18 Masahiro Yamada
  2020-02-10 18:58 ` Pavel Machek
                   ` (2 more replies)
  0 siblings, 3 replies; 5+ messages in thread
From: Masahiro Yamada @ 2020-02-10 16:18 UTC (permalink / raw)
  To: linux-kbuild; +Cc: youling257, Pavel Machek, linux-kernel, Masahiro Yamada

scripts/kallsyms crashes because memcpy() writes one more byte than
allocated.

Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
Reported-by: youling257 <youling257@gmail.com>
Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
---

 scripts/kallsyms.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index a566d8201b56..0133dfaaf352 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -210,7 +210,7 @@ static struct sym_entry *read_symbol(FILE *in)
 
 	len = strlen(name) + 1;
 
-	sym = malloc(sizeof(*sym) + len);
+	sym = malloc(sizeof(*sym) + len + 1);
 	if (!sym) {
 		fprintf(stderr, "kallsyms failure: "
 			"unable to allocate required amount of memory\n");
@@ -219,7 +219,7 @@ static struct sym_entry *read_symbol(FILE *in)
 	sym->addr = addr;
 	sym->len = len;
 	sym->sym[0] = type;
-	memcpy(sym_name(sym), name, len);
+	strcpy(sym_name(sym), name);
 	sym->percpu_absolute = 0;
 
 	return sym;
-- 
2.17.1


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run
  2020-02-10 16:18 [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run Masahiro Yamada
@ 2020-02-10 18:58 ` Pavel Machek
  2020-02-11  2:36 ` Justin Capella
  2020-02-12  9:20 ` Masahiro Yamada
  2 siblings, 0 replies; 5+ messages in thread
From: Pavel Machek @ 2020-02-10 18:58 UTC (permalink / raw)
  To: Masahiro Yamada; +Cc: linux-kbuild, youling257, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 599 bytes --]

On Tue 2020-02-11 01:18:52, Masahiro Yamada wrote:
> scripts/kallsyms crashes because memcpy() writes one more byte than
> allocated.
> 
> Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
> Reported-by: youling257 <youling257@gmail.com>
> Reported-by: Pavel Machek <pavel@ucw.cz>
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>


Tested-by: Pavel Machek <pavel@ucw.cz>

Thanks!
								Pavel
								
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run
  2020-02-10 16:18 [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run Masahiro Yamada
  2020-02-10 18:58 ` Pavel Machek
@ 2020-02-11  2:36 ` Justin Capella
  2020-02-11 14:46   ` Masahiro Yamada
  2020-02-12  9:20 ` Masahiro Yamada
  2 siblings, 1 reply; 5+ messages in thread
From: Justin Capella @ 2020-02-11  2:36 UTC (permalink / raw)
  To: Masahiro Yamada; +Cc: Linux Kbuild mailing list, youling257, Pavel Machek, LKML

Looks like len is already +1, maybe it shouldn't be?

>         len = strlen(name) + 1;
>
> -       sym = malloc(sizeof(*sym) + len);
> +       sym = malloc(sizeof(*sym) + len + 1);


Maybe strlcpy or if len wasn't incremented?

>
> -       memcpy(sym_name(sym), name, len);
> +       strcpy(sym_name(sym), name);
>

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run
  2020-02-11  2:36 ` Justin Capella
@ 2020-02-11 14:46   ` Masahiro Yamada
  0 siblings, 0 replies; 5+ messages in thread
From: Masahiro Yamada @ 2020-02-11 14:46 UTC (permalink / raw)
  To: Justin Capella; +Cc: Linux Kbuild mailing list, youling257, Pavel Machek, LKML

Hi.

On Tue, Feb 11, 2020 at 11:36 AM Justin Capella <justincapella@gmail.com> wrote:
>
> Looks like len is already +1, maybe it shouldn't be?

This increment is for storing one more character, 'type'.

        sym->sym[0] = type;



> >         len = strlen(name) + 1;
> >
> > -       sym = malloc(sizeof(*sym) + len);
> > +       sym = malloc(sizeof(*sym) + len + 1);


This increment is for the '\0' termination.



So, malloc() needs to allocate:
sizeof(*sym) + strlen(name) + 2.





>
>
> Maybe strlcpy or if len wasn't incremented?
>
> >
> > -       memcpy(sym_name(sym), name, len);
> > +       strcpy(sym_name(sym), name);
> >



-- 
Best Regards
Masahiro Yamada

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run
  2020-02-10 16:18 [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run Masahiro Yamada
  2020-02-10 18:58 ` Pavel Machek
  2020-02-11  2:36 ` Justin Capella
@ 2020-02-12  9:20 ` Masahiro Yamada
  2 siblings, 0 replies; 5+ messages in thread
From: Masahiro Yamada @ 2020-02-12  9:20 UTC (permalink / raw)
  To: Linux Kbuild mailing list
  Cc: youling257, Pavel Machek, Linux Kernel Mailing List

On Tue, Feb 11, 2020 at 1:19 AM Masahiro Yamada <masahiroy@kernel.org> wrote:
>
> scripts/kallsyms crashes because memcpy() writes one more byte than
> allocated.
>
> Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
> Reported-by: youling257 <youling257@gmail.com>
> Reported-by: Pavel Machek <pavel@ucw.cz>
> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
> ---

Applied.
I will send a pull request shortly
because many people are tripping over this bug.




>  scripts/kallsyms.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
> index a566d8201b56..0133dfaaf352 100644
> --- a/scripts/kallsyms.c
> +++ b/scripts/kallsyms.c
> @@ -210,7 +210,7 @@ static struct sym_entry *read_symbol(FILE *in)
>
>         len = strlen(name) + 1;
>
> -       sym = malloc(sizeof(*sym) + len);
> +       sym = malloc(sizeof(*sym) + len + 1);
>         if (!sym) {
>                 fprintf(stderr, "kallsyms failure: "
>                         "unable to allocate required amount of memory\n");
> @@ -219,7 +219,7 @@ static struct sym_entry *read_symbol(FILE *in)
>         sym->addr = addr;
>         sym->len = len;
>         sym->sym[0] = type;
> -       memcpy(sym_name(sym), name, len);
> +       strcpy(sym_name(sym), name);
>         sym->percpu_absolute = 0;
>
>         return sym;
> --
> 2.17.1
>


-- 
Best Regards
Masahiro Yamada

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2020-02-12  9:21 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-02-10 16:18 [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run Masahiro Yamada
2020-02-10 18:58 ` Pavel Machek
2020-02-11  2:36 ` Justin Capella
2020-02-11 14:46   ` Masahiro Yamada
2020-02-12  9:20 ` Masahiro Yamada

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).