[PATCH] scripts: check_extable: match allowlisted section names exactly

[PATCH] scripts: check_extable: match allowlisted section names exactly

[Hamdy Abou El Anein]

From: Hamdy Abou El Anein <hamdy.aea@protonmail.com>

The unanchored .text and .fixup expressions match more than the two
allowlisted sections. For example, relocations into non-executable
.text.data or .fixup_data sections are silently skipped. The unescaped
dot also matches a section called atext.

Filter the relocation target field with anchored, escaped section
names and an optional relocation addend. Apply the same exact match
after resolving a symbol to its section.

Tested assembled ELF objects with .text and .fixup targets, and with
non-executable .data, .text.data, .fixup_data and atext targets. The
allowlisted sections still pass; all non-executable targets are
reported and cause a nonzero exit.

AI assistance: ChatGPT/Codex identified the issue and prepared the
change, commit message and executable regression tests.

Fixes: c31e4b832f12 ("scripts: add check_extable.sh script.")
Signed-off-by: Hamdy Abou El Anein <hamdy.aea@protonmail.com>
---
 scripts/check_extable.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/check_extable.sh b/scripts/check_extable.sh
index 4b380564cf7..eb299e182d9 100755
--- a/scripts/check_extable.sh
+++ b/scripts/check_extable.sh
@@ -10,10 +10,10 @@ file ${obj} | grep -q ELF || (echo "${obj} is not an ELF file." 1>&2 ; exit 0)
 objdump -hj __ex_table ${obj} 2> /dev/null > /dev/null
 [ $? -ne 0 ] && exit 0
 
-white_list=.text,.fixup
+white_list='(\.text|\.fixup)'
 
 suspicious_relocs=$(objdump -rj __ex_table ${obj}  | tail -n +6 |
-			grep -v $(eval echo -e{${white_list}}) | awk '{print $3}')
+			awk 'NF {print $3}' | grep -Ev "^${white_list}([+-]0x[0-9a-f]+)?$")
 
 # No suspicious relocs in __ex_table, jobs a good'un
 [ -z "${suspicious_relocs}" ] && exit 0
@@ -120,7 +120,7 @@ function diagnose()
 	# In this case objdump was presenting us with a reloc to a symbol
 	# rather than a section. Now that we've got the actual section,
 	# we can skip it if it's in the white_list.
-	if [ -z "$( echo $section | grep -v $(eval echo -e{${white_list}}))" ]; then
+	if [ -z "$( echo $section | grep -Ev "^${white_list}$")" ]; then
 	    continue;
 	fi