linux-kernel - Re: [PATCH v2] kallsyms: Fix wrong "big" kernel symbol type read from procfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <deea0784-45a0-03b8-b2a6-ed4fa10f1df5@huaweicloud.com>
Date: Sat, 12 Oct 2024 09:36:07 +0800
From: Zheng Yejian <zhengyejian@...weicloud.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: arnd@...db.de, kees@...nel.org, mcgrof@...nel.org, masahiroy@...nel.org,
 ndesaulniers@...gle.com, ardb@...nel.org, jannh@...gle.com, song@...nel.org,
 boqun.feng@...il.com, gregkh@...uxfoundation.org, gary@...yguo.net,
 wedsonaf@...gle.com, linux-kernel@...r.kernel.org, yeweihua4@...wei.com
Subject: Re: [PATCH v2] kallsyms: Fix wrong "big" kernel symbol type read from
 procfs

On 2024/10/12 06:01, Matthew Wilcox wrote:
> On Fri, Oct 11, 2024 at 10:38:53PM +0800, Zheng Yejian wrote:
>> The root cause is that, after commit 73bbb94466fd ("kallsyms: support
>> "big" kernel symbols"), ULEB128 was used to encode symbol name length.
>> That is, for "big" kernel symbols of which name length is longer than
>> 0x7f characters, the length info is encoded into 2 bytes.
> 
> Technically, at least two.  If we ever have a symbol larger than
> 16kB, we'll use three bytes.
> 

Well, yes!

>> +++ b/kernel/kallsyms.c
>> @@ -103,8 +103,11 @@ static char kallsyms_get_symbol_type(unsigned int off)
>>   {
>>   	/*
>>   	 * Get just the first code, look it up in the token table,
>> -	 * and return the first char from this token.
>> +	 * and return the first char from this token. If MSB of length
>> +	 * is 1, it is a "big" symbol, so needs an additional byte.
>>   	 */
>> +	if (kallsyms_names[off] & 0x80)
>> +		off++;
> 
> So this "if" should be a "while" for maximum future proofing against the
> day that we have a 16kB function ...

I'll test it and send a v3.

-- 
Thanks,
Zheng Yejian