[PATCH 4/5] elf-parse: check the symbol table before walking it

[Leizhen Zhang <lzsx618@gmail.com>]

elf_open_ro() ends with

	elf->nr_syms = shdr_size(elf->symtab) / shdr_entsize(elf->symtab);

on a section header taken from the file. A zero sh_entsize divides by
zero, and an sh_size that runs past the end of the mapping produces a
symbol count bounded by nothing: scripts/kallsyms-sysmap.c allocates
nr_syms entries up front and then reads every one of them.

Found by fuzzing the host ELF tools with mutated object files under
ASan/UBSan. Both reproducers change one field of the symbol table's
section header in an otherwise valid vmlinux:

  sh_entsize = 0
    ./kallsyms --sysmap=/dev/null t.elf
    scripts/elf-parse.c:266:40: runtime error: division by zero
      #0 in elf_open_ro scripts/elf-parse.c:266

  sh_size = 0x7fffffff0000
    ./kallsyms --sysmap=/dev/null t.elf
    ERROR: AddressSanitizer: requested allocation size 0x7ffffffefff0
    exceeds maximum supported size
      #0 in malloc
      #1 in xmalloc scripts/include/xalloc.h
      #2 in elf_read_symbols scripts/kallsyms-sysmap.c:195

Require an entry size that can hold a symbol of the file's class, and a
table that lies inside the mapping. Both reproducers then print "symbol
table out of range" and exit 1, while a vmlinux and a shared object are
read unchanged.

One UBSan report in this area is deliberately not addressed here: an
unaligned sh_offset makes elf_symbol() form a misaligned Elf_Sym
pointer, which the header's accessors then dereference. Rejecting it on
alignment would also reject legitimate ELF32 objects, whose symbol
tables need only 4-byte alignment while the Elf_Sym union requires 8, so
that one needs the accessors to read unaligned instead of a check here.

This code is only in linux-next, from the "kbuild: significantly speed
up kernel builds" series, so there is no mainline commit to reference in
a Fixes tag.

Assisted-by: LLM ASan UBSan
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
 scripts/elf-parse.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/scripts/elf-parse.c b/scripts/elf-parse.c
index 39ac25ddf188..756843c433ee 100644
--- a/scripts/elf-parse.c
+++ b/scripts/elf-parse.c
@@ -271,6 +271,26 @@ static bool elf_shnum_out_of_range(const struct elf_file *elf)
 	return (elf->size - shoff) / elf->shentsize < elf->shnum;
 }
 
+/*
+ * True when the symbol table cannot be walked inside the mapping: an entry
+ * size too small to hold a symbol divides by zero (or steps through the file
+ * in the wrong units) below, and a table running past the end of the file is
+ * read out of bounds -- its size also drives the allocation in the callers.
+ */
+static bool elf_symtab_out_of_range(const struct elf_file *elf)
+{
+	size_t offset = shdr_offset(elf->symtab);
+	size_t size = shdr_size(elf->symtab);
+	size_t entsize = shdr_entsize(elf->symtab);
+	size_t minsize = elf_map_long_size(elf->base) == 4 ?
+			 sizeof(Elf32_Sym) : sizeof(Elf64_Sym);
+
+	if (entsize < minsize)
+		return true;
+
+	return offset > elf->size || elf->size - offset < size;
+}
+
 /*
  * Open an ELF file and map it read-only, locating its section headers, section
  * names and symbol table which are populated in the elf out parameter.
@@ -324,6 +344,12 @@ int elf_open_ro(char const *fname, uint32_t types, struct elf_file *elf)
 		return -1;
 	}
 
+	if (elf_symtab_out_of_range(elf)) {
+		fprintf(stderr, "%s: symbol table out of range\n", fname);
+		elf_close(elf);
+		return -1;
+	}
+
 	if (shdr_link(elf->symtab) >= elf->shnum) {
 		fprintf(stderr, "%s: symbol table has no string table\n", fname);
 		elf_close(elf);
-- 
2.34.1