[PATCH v3] tracepoint-update: check the section end before reading a string

[PATCH v3] tracepoint-update: check the section end before reading a string

[Leizhen Zhang]

for_each_shdr_str() evaluates strlen(str) before checking str < end.
A string section always ends in a NUL, so the last iteration always
steps str to end and then calls strlen() on the bytes just past the
section. This is not limited to malformed input: running the tool on
the vmlinux.o of a plain defconfig build, as "make UT=1" does, takes
that path in both loops that use the macro.

It does no harm today because what follows the section is another part
of the same mapped file, but it is still a read outside the section on
every such run. Check the bound first; the loop is otherwise unchanged.

The problem was found with ASan, and the analysis and fix were
prepared with the help of an AI coding assistant; I reviewed and
tested the result.

Fixes: e30f8e61e251 ("tracing: Add a tracepoint verification check at build time")
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
Changes in v3:
- Dropped v2 1/2 ("do not reuse section pointers from a previous file"):
  Kbuild only ever passes one file per invocation, so no real build can
  reach it.
- Reworded the commit message to say where the read actually happens:
  I checked with an instrumented copy of the tool, and both loops step
  onto the section end when run on a defconfig vmlinux.o.
- Rebased onto v7.4-rc1.
- Replaced the Assisted-by trailer with a sentence in the changelog.

v2: https://lore.kernel.org/r/20261008164117.3670267-2-lzsx618@gmail.com

 scripts/tracepoint-update.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/tracepoint-update.c b/scripts/tracepoint-update.c
index 5cf43c0aac89..c70c0b076554 100644
--- a/scripts/tracepoint-update.c
+++ b/scripts/tracepoint-update.c
@@ -74,7 +74,7 @@ static int add_string(const char *str, const char ***vals, int *count)
 #define for_each_shdr_str(len, ehdr, sec)				\
 	for (const char *str = (void *)(ehdr) + shdr_offset(sec),	\
 			*end = str + shdr_size(sec);			\
-	     len = strlen(str), str < end;				\
+	     str < end && (len = strlen(str), true);			\
 	     str += (len) + 1)
 
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.34.1