[PATCH 5/5] elf-parse: bound symbol names by the string table

[Leizhen Zhang <lzsx618@gmail.com>]

elf_read_symbols() builds every name as

	const char *name = elf->strtab + sym_name(sym);

st_name is a 32-bit field read from the file and nothing bounds it, so a
single symbol can point the name anywhere, and sysmap_omits() then reads
a string from there.

Found by fuzzing the host ELF tools with mutated object files under
ASan/UBSan. Reproducer, setting only st_name of one object symbol in an
otherwise valid vmlinux (symbol 2 of its symbol table here, the first
one whose type makes the name be read):

  ./kallsyms --sysmap=/dev/null t.elf
  ERROR: AddressSanitizer: SEGV on unknown address 0x7f54e308c740
    #0 in strncmp
    #1 in string_starts_with scripts/kallsyms.h:15
    #2 in sysmap_omits scripts/kallsyms-sysmap.c:104

Record the size of the string table in struct elf_file and check, in
elf_open_ro(), that the table is inside the mapping and ends in a NUL.
A name that starts inside such a table also ends inside it, so a single
offset comparison is then enough, which elf_symbol_name() does; symbols
whose name is out of range are skipped like the other uninteresting ones
rather than failing the build, keeping the behaviour for every object a
toolchain actually produces identical.

scripts/sorttable.c reads symbol names the same way from its own
mapping, through elf_map() rather than elf_open_ro(). That path looks to
have the same gap, but every input I built was rejected earlier for
missing ORC tables, so I have no reproducer for it and have left it
alone rather than guess.

This code is only in linux-next, from the "kbuild: significantly speed
up kernel builds" series, so there is no mainline commit to reference in
a Fixes tag.

Assisted-by: LLM ASan UBSan
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
 scripts/elf-parse.c       | 21 ++++++++++++++++++---
 scripts/elf-parse.h       | 14 ++++++++++++++
 scripts/kallsyms-sysmap.c |  4 ++--
 3 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/scripts/elf-parse.c b/scripts/elf-parse.c
index 756843c433ee..8083b9ec3477 100644
--- a/scripts/elf-parse.c
+++ b/scripts/elf-parse.c
@@ -300,7 +300,8 @@ static bool elf_symtab_out_of_range(const struct elf_file *elf)
 int elf_open_ro(char const *fname, uint32_t types, struct elf_file *elf)
 {
 	Elf_Ehdr *ehdr;
-	Elf_Shdr *first;
+	Elf_Shdr *first, *strtab;
+	size_t stroff;
 	unsigned int shstrndx, i;
 
 	memset(elf, 0, sizeof(*elf));
@@ -355,8 +356,22 @@ int elf_open_ro(char const *fname, uint32_t types, struct elf_file *elf)
 		elf_close(elf);
 		return -1;
 	}
-	elf->strtab = (const char *)elf->base +
-		      shdr_offset(elf_section(elf, shdr_link(elf->symtab)));
+	strtab = elf_section(elf, shdr_link(elf->symtab));
+	stroff = shdr_offset(strtab);
+	elf->strtab_size = shdr_size(strtab);
+	elf->strtab = (const char *)elf->base + stroff;
+	/*
+	 * Symbol names are read by offset into this table, so it has to be
+	 * inside the mapping and has to end in a NUL for a name that starts
+	 * inside it to end inside it as well.
+	 */
+	if (stroff > elf->size || elf->size - stroff < elf->strtab_size ||
+	    !elf->strtab_size || elf->strtab[elf->strtab_size - 1]) {
+		fprintf(stderr, "%s: symbol string table out of range\n",
+			fname);
+		elf_close(elf);
+		return -1;
+	}
 	elf->nr_syms = shdr_size(elf->symtab) / shdr_entsize(elf->symtab);
 
 	return 0;
diff --git a/scripts/elf-parse.h b/scripts/elf-parse.h
index c5ad754da254..548c80ead2bf 100644
--- a/scripts/elf-parse.h
+++ b/scripts/elf-parse.h
@@ -330,6 +330,7 @@ struct elf_file {
 	const char *shstrtab;
 	Elf_Shdr *symtab;
 	const char *strtab;
+	size_t strtab_size;
 	size_t nr_syms;
 };
 
@@ -356,4 +357,17 @@ static inline Elf_Sym *elf_symbol(const struct elf_file *elf, size_t index)
 			   index * shdr_entsize(elf->symtab));
 }
 
+/*
+ * The name of a symbol, or NULL when st_name points outside the string table.
+ * elf_open_ro() has checked that the table is inside the mapping and ends in a
+ * NUL, so a name that starts inside it also ends inside it.
+ */
+static inline const char *elf_symbol_name(const struct elf_file *elf,
+					  Elf_Sym *sym)
+{
+	size_t offset = sym_name(sym);
+
+	return offset < elf->strtab_size ? elf->strtab + offset : NULL;
+}
+
 #endif /* _SCRIPTS_ELF_PARSE_H */
diff --git a/scripts/kallsyms-sysmap.c b/scripts/kallsyms-sysmap.c
index a482968eba51..efca13ab9dc3 100644
--- a/scripts/kallsyms-sysmap.c
+++ b/scripts/kallsyms-sysmap.c
@@ -198,10 +198,10 @@ static struct sysmap_symbol *elf_read_symbols(const struct elf_file *elf,
 
 	for (i = 1; i < elf->nr_syms; i++) {
 		Elf_Sym *sym = elf_symbol(elf, i);
-		const char *name = elf->strtab + sym_name(sym);
+		const char *name = elf_symbol_name(elf, sym);
 		char type = elf_symbol_type(elf, sym);
 
-		if (!type || sysmap_omits(name, type))
+		if (!name || !type || sysmap_omits(name, type))
 			continue;
 
 		syms[n].addr = sym_value(sym);
-- 
2.34.1