linux-kernel - Re: [PATCH v2] kallsyms: Fix wrong "big" kernel symbol type read from procfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZwmgKHxgl2BQuKp6@casper.infradead.org>
Date: Fri, 11 Oct 2024 23:01:12 +0100
From: Matthew Wilcox <willy@...radead.org>
To: Zheng Yejian <zhengyejian@...weicloud.com>
Cc: arnd@...db.de, kees@...nel.org, mcgrof@...nel.org, masahiroy@...nel.org,
	ndesaulniers@...gle.com, ardb@...nel.org, jannh@...gle.com,
	song@...nel.org, boqun.feng@...il.com, gregkh@...uxfoundation.org,
	gary@...yguo.net, wedsonaf@...gle.com, linux-kernel@...r.kernel.org,
	yeweihua4@...wei.com
Subject: Re: [PATCH v2] kallsyms: Fix wrong "big" kernel symbol type read
 from procfs

On Fri, Oct 11, 2024 at 10:38:53PM +0800, Zheng Yejian wrote:
> The root cause is that, after commit 73bbb94466fd ("kallsyms: support
> "big" kernel symbols"), ULEB128 was used to encode symbol name length.
> That is, for "big" kernel symbols of which name length is longer than
> 0x7f characters, the length info is encoded into 2 bytes.

Technically, at least two.  If we ever have a symbol larger than
16kB, we'll use three bytes.

> +++ b/kernel/kallsyms.c
> @@ -103,8 +103,11 @@ static char kallsyms_get_symbol_type(unsigned int off)
>  {
>  	/*
>  	 * Get just the first code, look it up in the token table,
> -	 * and return the first char from this token.
> +	 * and return the first char from this token. If MSB of length
> +	 * is 1, it is a "big" symbol, so needs an additional byte.
>  	 */
> +	if (kallsyms_names[off] & 0x80)
> +		off++;

So this "if" should be a "while" for maximum future proofing against the
day that we have a 16kB function ...