[PATCH 3/5] elf-parse: check the section indices that elf_open_ro() takes from the file

[Leizhen Zhang <lzsx618@gmail.com>]

elf_open_ro() resolves two values that the ELF header can delegate to
section 0 -- the section count when e_shnum is SHN_UNDEF, and the section
name index when e_shstrndx is SHN_XINDEX -- and then looks up the string
table of the symbol table through its sh_link. None of the three is
checked, so each one indexes the section header table with a value taken
straight from the file.

Found by fuzzing the host ELF tools with mutated object files under
ASan/UBSan. Setting only the sh_link of the symbol table in an otherwise
valid vmlinux (the strtab index it resolves):

  ./kallsyms --sysmap=/dev/null t.elf
  ERROR: AddressSanitizer: SEGV on unknown address
    #0 in strncmp
    #1 in sysmap_omits scripts/kallsyms-sysmap.c
  -- elf->strtab points outside the mapping, and every symbol name is
     then read through it.

With the preceding patch in place the header-supplied count and index
are already rejected before this point; the values that come out of
section 0 are not, which is what this adds, together with the sh_link of
the symbol table. elf_shnum_out_of_range() repeats the extent check from
elf_parse() against the count actually in use.

The reproducer now prints "symbol table has no string table" and exits
1, and a vmlinux and a shared object are still read unchanged.

This code is only in linux-next, from the "kbuild: significantly speed
up kernel builds" series, so there is no mainline commit to reference in
a Fixes tag.

Assisted-by: LLM ASan UBSan
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
 scripts/elf-parse.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/scripts/elf-parse.c b/scripts/elf-parse.c
index 0e16a9cf67f4..39ac25ddf188 100644
--- a/scripts/elf-parse.c
+++ b/scripts/elf-parse.c
@@ -256,6 +256,21 @@ void elf_unmap(void *addr, size_t size)
 	munmap(addr, size);
 }
 
+/*
+ * True when the section header count does not fit in the mapping. The count
+ * can come from section 0, so it is not covered by the header check in
+ * elf_parse().
+ */
+static bool elf_shnum_out_of_range(const struct elf_file *elf)
+{
+	size_t shoff = (size_t)(elf->shdrs - (const char *)elf->base);
+
+	if (!elf->shnum || !elf->shentsize || shoff > elf->size)
+		return true;
+
+	return (elf->size - shoff) / elf->shentsize < elf->shnum;
+}
+
 /*
  * Open an ELF file and map it read-only, locating its section headers, section
  * names and symbol table which are populated in the elf out parameter.
@@ -285,6 +300,17 @@ int elf_open_ro(char const *fname, uint32_t types, struct elf_file *elf)
 	shstrndx = ehdr_shstrndx(ehdr);
 	if (shstrndx == SHN_XINDEX)
 		shstrndx = shdr_link(first);
+
+	/*
+	 * elf_parse() checked the count and the name index carried by the ELF
+	 * header, but both can instead come from section 0, and that index is
+	 * unchecked. Recheck whatever was actually used.
+	 */
+	if (elf_shnum_out_of_range(elf) || shstrndx >= elf->shnum) {
+		fprintf(stderr, "%s: ELF section headers out of range\n", fname);
+		elf_close(elf);
+		return -1;
+	}
 	elf->shstrtab = (const char *)elf->base +
 			shdr_offset(elf_section(elf, shstrndx));
 
@@ -298,6 +324,11 @@ int elf_open_ro(char const *fname, uint32_t types, struct elf_file *elf)
 		return -1;
 	}
 
+	if (shdr_link(elf->symtab) >= elf->shnum) {
+		fprintf(stderr, "%s: symbol table has no string table\n", fname);
+		elf_close(elf);
+		return -1;
+	}
 	elf->strtab = (const char *)elf->base +
 		      shdr_offset(elf_section(elf, shdr_link(elf->symtab)));
 	elf->nr_syms = shdr_size(elf->symtab) / shdr_entsize(elf->symtab);
-- 
2.34.1