[PATCH v3 0/6] kbuild: fix UB hit by normal builds in host tools

[Leizhen Zhang <lzsx618@gmail.com>]

This is v3 of the host tool fixes. The main change is what is left in
it: following the feedback on my elf-parse series, I went back over
every patch and kept only the ones a normal build or valid source can
trigger. Each of the six below was re-checked on mainline as of
b23545529c21 (the rc1 rebase changed no code) by doing a plain x86_64
defconfig build (MODVERSIONS and MODULE_SRCVERSION_ALL enabled, 12
modules) with the host tools built with sanitizers, and then rerunning
the same step with the patch applied:

  1/6 genksyms   'int a, f(int);' is valid C and makes genksyms loop
                 forever; 'int a; int f(int);' is fine.
  2/6 kallsyms   link-vmlinux.sh hands kallsyms an empty .syms file on
                 every build (the .tmp_vmlinux0 pass), and both qsort()
                 calls then get a NULL table. 2 UBSan reports -> 0, the
                 generated tables are byte-identical.
  3/6 modpost    read_text_file() rereads into the start of the buffer
                 after a short read. Not something a local filesystem
                 does in practice; shown with an LD_PRELOAD shim that
                 caps read() at 64 bytes, under which modpost rejects a
                 valid Module.symvers.
  4/6 modpost    parse_source_files() does arithmetic on the NULL that
                 strstr() returns for dependencies outside the module's
                 directory. Reported on the build's own modpost
                 invocation; Module.symvers is identical with the fix.
  5/6 sorttable  the sort_needed address is computed by adding a kernel
                 virtual address to a host pointer first. Reported on
                 the real vmlinux.
  6/6 tools      __get_unaligned_le32() shifts a byte >= 0x80 into the
                 sign bit. Hit 4 times during the defconfig link, by
                 sorttable.

The 4/6 and 5/6 reports need clang's -fsanitize=undefined; GCC 12 does
not instrument those two pointer-arithmetic cases, so they are silent
with a GCC host build.

The 2/6 and 6/6 reports reproduce unchanged on v7.4-rc2 (GCC host
build, same config).

Changes in v3:
- Rebased onto v7.4-rc1. No code changes in the patches that remain.
- Dropped "fixdep: fix out-of-bounds read on a comment ending with a
  backslash": it needs a hand-written .d file; the compiler never
  produces one.
- Dropped "modpost: fix stack out-of-bounds read for unterminated PNP
  ids": all 699 PNP ids in the tree are 7 characters, and the overflow
  needs an 8-character one, which is not a well-formed PNP id.
- Replaced the Assisted-by trailers, which checkpatch no longer
  accepts, with a sentence in each changelog saying how the problem was
  found and that an AI coding assistant helped prepare the fix.

v2: https://lore.kernel.org/r/20261008164035.3668885-1-lzsx618@gmail.com

Leizhen Zhang (6):
  genksyms: fix infinite loop on declarations with parameter lists
  kallsyms: do not call qsort() with a NULL table
  modpost: fix handling of short reads in read_text_file()
  modpost: fix pointer arithmetic on NULL in parse_source_files()
  sorttable: avoid pointer arithmetic overflow when locating sort_needed
  tools/include: fix signed shift overflow in 32-bit unaligned accessors

 scripts/genksyms/parse.y           | 23 +++++++++++++++++++----
 scripts/kallsyms.c                 |  6 ++++--
 scripts/mod/modpost.c              |  6 +++++-
 scripts/mod/sumversion.c           |  3 ++-
 scripts/sorttable.c                |  2 +-
 tools/include/tools/be_byteshift.h |  2 +-
 tools/include/tools/le_byteshift.h |  2 +-
 7 files changed, 33 insertions(+), 11 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.34.1