lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 27/34] modpost: fix undefined behavior of is_arm_mapping_symbol()
    Date
    From: Masahiro Yamada <masahiroy@kernel.org>

    [ Upstream commit d6b732666a1bae0df3c3ae06925043bba34502b1 ]

    The return value of is_arm_mapping_symbol() is unpredictable when "$"
    is passed in.

    strchr(3) says:
    The strchr() and strrchr() functions return a pointer to the matched
    character or NULL if the character is not found. The terminating null
    byte is considered part of the string, so that if c is specified as
    '\0', these functions return a pointer to the terminator.

    When str[1] is '\0', strchr("axtd", str[1]) is not NULL, and str[2] is
    referenced (i.e. buffer overrun).

    Test code
    ---------

    char str1[] = "abc";
    char str2[] = "ab";

    strcpy(str1, "$");
    strcpy(str2, "$");

    printf("test1: %d\n", is_arm_mapping_symbol(str1));
    printf("test2: %d\n", is_arm_mapping_symbol(str2));

    Result
    ------

    test1: 0
    test2: 1

    Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
    Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    scripts/mod/modpost.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
    index 13cda6aa2688..a878c79fe95a 100644
    --- a/scripts/mod/modpost.c
    +++ b/scripts/mod/modpost.c
    @@ -1283,7 +1283,8 @@ static int secref_whitelist(const struct sectioncheck *mismatch,

    static inline int is_arm_mapping_symbol(const char *str)
    {
    - return str[0] == '$' && strchr("axtd", str[1])
    + return str[0] == '$' &&
    + (str[1] == 'a' || str[1] == 'd' || str[1] == 't' || str[1] == 'x')
    && (str[2] == '\0' || str[2] == '.');
    }

    --
    2.35.1
    \
     
     \ /
      Last update: 2022-06-07 21:43    [W:2.466 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site