Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

kernel: kallsyms: memory override issue, need check destination buffer length

Browse source 
We don't export any symbols > 128 characters, but if we did then
  kallsyms_expand_symbol() would overflow the buffer handed to it.
  So we need check destination buffer length when copying.

  the related test:
    if we define an EXPORT function which name more than 128.
    will panic when call kallsyms_lookup_name by init_kprobes on booting.
    after check the length (provide this patch), it is ok.

  Implementaion:
    add additional destination buffer length parameter (maxlen)
    if uncompressed string is too long (>= maxlen), it will be truncated.
    not check the parameters whether valid, since it is a static function.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
This commit is contained in:
Chen Gang 2013-04-15 15:04:43 +09:30 committed by Rusty Russell
parent 07c449bbc6
commit e3f26752f0
1 changed files with 18 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
kernel/kallsyms.c
View file

@ -84,9 +84,11 @@ static int is_ksym_addr(unsigned long addr)
/* /*
* Expand a compressed symbol data into the resulting uncompressed string, * Expand a compressed symbol data into the resulting uncompressed string,
* if uncompressed string is too long (>= maxlen), it will be truncated,
* given the offset to where the symbol is in the compressed stream. * given the offset to where the symbol is in the compressed stream.
*/ */
static unsigned int kallsyms_expand_symbol(unsigned int off, char *result) static unsigned int kallsyms_expand_symbol(unsigned int off,
char *result, size_t maxlen)
{ {
int len, skipped_first = 0; int len, skipped_first = 0;
const u8 *tptr, *data; const u8 *tptr, *data;
@ -113,15 +115,20 @@ static unsigned int kallsyms_expand_symbol(unsigned int off, char *result)
while (*tptr) { while (*tptr) {
if (skipped_first) { if (skipped_first) {
if (maxlen <= 1)
goto tail;
*result = *tptr; *result = *tptr;
result++; result++;
maxlen--;
} else } else
skipped_first = 1; skipped_first = 1;
tptr++; tptr++;
} }
} }
*result = '\0'; tail:
if (maxlen)
*result = '\0';
/* Return to offset to the next symbol. */ /* Return to offset to the next symbol. */
return off; return off;
@ -176,7 +183,7 @@ unsigned long kallsyms_lookup_name(const char *name)
unsigned int off; unsigned int off;
for (i = 0, off = 0; i < kallsyms_num_syms; i++) { for (i = 0, off = 0; i < kallsyms_num_syms; i++) {
off = kallsyms_expand_symbol(off, namebuf); off = kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
if (strcmp(namebuf, name) == 0) if (strcmp(namebuf, name) == 0)
return kallsyms_addresses[i]; return kallsyms_addresses[i];
@ -195,7 +202,7 @@ int kallsyms_on_each_symbol(int (*fn)(void *, const char *, struct module *,
int ret; int ret;
for (i = 0, off = 0; i < kallsyms_num_syms; i++) { for (i = 0, off = 0; i < kallsyms_num_syms; i++) {
off = kallsyms_expand_symbol(off, namebuf); off = kallsyms_expand_symbol(off, namebuf, ARRAY_SIZE(namebuf));
ret = fn(data, namebuf, NULL, kallsyms_addresses[i]); ret = fn(data, namebuf, NULL, kallsyms_addresses[i]);
if (ret != 0) if (ret != 0)
return ret; return ret;
@ -294,7 +301,8 @@ const char *kallsyms_lookup(unsigned long addr,
pos = get_symbol_pos(addr, symbolsize, offset); pos = get_symbol_pos(addr, symbolsize, offset);
/* Grab name */ /* Grab name */
kallsyms_expand_symbol(get_symbol_offset(pos), namebuf); kallsyms_expand_symbol(get_symbol_offset(pos),
namebuf, KSYM_NAME_LEN);
if (modname) if (modname)
*modname = NULL; *modname = NULL;
return namebuf; return namebuf;
@ -315,7 +323,8 @@ int lookup_symbol_name(unsigned long addr, char *symname)
pos = get_symbol_pos(addr, NULL, NULL); pos = get_symbol_pos(addr, NULL, NULL);
/* Grab name */ /* Grab name */
kallsyms_expand_symbol(get_symbol_offset(pos), symname); kallsyms_expand_symbol(get_symbol_offset(pos),
symname, KSYM_NAME_LEN);
return 0; return 0;
} }
/* See if it's in a module. */ /* See if it's in a module. */
@ -333,7 +342,8 @@ int lookup_symbol_attrs(unsigned long addr, unsigned long *size,
pos = get_symbol_pos(addr, size, offset); pos = get_symbol_pos(addr, size, offset);
/* Grab name */ /* Grab name */
kallsyms_expand_symbol(get_symbol_offset(pos), name); kallsyms_expand_symbol(get_symbol_offset(pos),
name, KSYM_NAME_LEN);
modname[0] = '\0'; modname[0] = '\0';
return 0; return 0;
} }
@ -463,7 +473,7 @@ static unsigned long get_ksymbol_core(struct kallsym_iter *iter)
iter->type = kallsyms_get_symbol_type(off); iter->type = kallsyms_get_symbol_type(off);
off = kallsyms_expand_symbol(off, iter->name); off = kallsyms_expand_symbol(off, iter->name, ARRAY_SIZE(iter->name));
return off - iter->nameoff; return off - iter->nameoff;
} }