2020-02-10 16:20:42

by Masahiro Yamada

[permalink] [raw]
Subject: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

scripts/kallsyms crashes because memcpy() writes one more byte than
allocated.

Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
Reported-by: youling257 <[email protected]>
Reported-by: Pavel Machek <[email protected]>
Signed-off-by: Masahiro Yamada <[email protected]>
---

scripts/kallsyms.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
index a566d8201b56..0133dfaaf352 100644
--- a/scripts/kallsyms.c
+++ b/scripts/kallsyms.c
@@ -210,7 +210,7 @@ static struct sym_entry *read_symbol(FILE *in)

len = strlen(name) + 1;

- sym = malloc(sizeof(*sym) + len);
+ sym = malloc(sizeof(*sym) + len + 1);
if (!sym) {
fprintf(stderr, "kallsyms failure: "
"unable to allocate required amount of memory\n");
@@ -219,7 +219,7 @@ static struct sym_entry *read_symbol(FILE *in)
sym->addr = addr;
sym->len = len;
sym->sym[0] = type;
- memcpy(sym_name(sym), name, len);
+ strcpy(sym_name(sym), name);
sym->percpu_absolute = 0;

return sym;
--
2.17.1


2020-02-10 18:58:48

by Pavel Machek

[permalink] [raw]
Subject: Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

On Tue 2020-02-11 01:18:52, Masahiro Yamada wrote:
> scripts/kallsyms crashes because memcpy() writes one more byte than
> allocated.
>
> Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
> Reported-by: youling257 <[email protected]>
> Reported-by: Pavel Machek <[email protected]>
> Signed-off-by: Masahiro Yamada <[email protected]>


Tested-by: Pavel Machek <[email protected]>

Thanks!
Pavel

--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html


Attachments:
(No filename) (599.00 B)
signature.asc (188.00 B)
Digital signature
Download all attachments

2020-02-11 02:39:01

by Justin Capella

[permalink] [raw]
Subject: Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

Looks like len is already +1, maybe it shouldn't be?

> len = strlen(name) + 1;
>
> - sym = malloc(sizeof(*sym) + len);
> + sym = malloc(sizeof(*sym) + len + 1);


Maybe strlcpy or if len wasn't incremented?

>
> - memcpy(sym_name(sym), name, len);
> + strcpy(sym_name(sym), name);
>

2020-02-11 16:46:45

by Masahiro Yamada

[permalink] [raw]
Subject: Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

Hi.

On Tue, Feb 11, 2020 at 11:36 AM Justin Capella <[email protected]> wrote:
>
> Looks like len is already +1, maybe it shouldn't be?

This increment is for storing one more character, 'type'.

sym->sym[0] = type;



> > len = strlen(name) + 1;
> >
> > - sym = malloc(sizeof(*sym) + len);
> > + sym = malloc(sizeof(*sym) + len + 1);


This increment is for the '\0' termination.



So, malloc() needs to allocate:
sizeof(*sym) + strlen(name) + 2.





>
>
> Maybe strlcpy or if len wasn't incremented?
>
> >
> > - memcpy(sym_name(sym), name, len);
> > + strcpy(sym_name(sym), name);
> >



--
Best Regards
Masahiro Yamada

2020-02-12 09:22:18

by Masahiro Yamada

[permalink] [raw]
Subject: Re: [PATCH] scripts/kallsyms: fix memory corruption caused by write over-run

On Tue, Feb 11, 2020 at 1:19 AM Masahiro Yamada <[email protected]> wrote:
>
> scripts/kallsyms crashes because memcpy() writes one more byte than
> allocated.
>
> Fixes: 8d60526999aa ("scripts/kallsyms: change table to store (strcut sym_entry *)")
> Reported-by: youling257 <[email protected]>
> Reported-by: Pavel Machek <[email protected]>
> Signed-off-by: Masahiro Yamada <[email protected]>
> ---

Applied.
I will send a pull request shortly
because many people are tripping over this bug.




> scripts/kallsyms.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
> index a566d8201b56..0133dfaaf352 100644
> --- a/scripts/kallsyms.c
> +++ b/scripts/kallsyms.c
> @@ -210,7 +210,7 @@ static struct sym_entry *read_symbol(FILE *in)
>
> len = strlen(name) + 1;
>
> - sym = malloc(sizeof(*sym) + len);
> + sym = malloc(sizeof(*sym) + len + 1);
> if (!sym) {
> fprintf(stderr, "kallsyms failure: "
> "unable to allocate required amount of memory\n");
> @@ -219,7 +219,7 @@ static struct sym_entry *read_symbol(FILE *in)
> sym->addr = addr;
> sym->len = len;
> sym->sym[0] = type;
> - memcpy(sym_name(sym), name, len);
> + strcpy(sym_name(sym), name);
> sym->percpu_absolute = 0;
>
> return sym;
> --
> 2.17.1
>


--
Best Regards
Masahiro Yamada