[Xen-changelog] [xen staging] xen/tools/symbols.c: fix potential segfault

[patchbot@xxxxxxx]

commit d59e4dadba52b40c4a5f07f18039b42323469672
Author:     Xiaochen Wang <wangxiaochen0@xxxxxxxxx>
AuthorDate: Wed Apr 3 10:18:20 2019 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Apr 3 10:18:20 2019 +0200

    xen/tools/symbols.c: fix potential segfault
    
    Description:
    This bug hardly appears during real kernel compiling,
     because the vmlinux symbols table is huge.
    
    But we can still catch it under strict condition , as follows.
       $ echo "c101b97b T do_fork" | ./scripts/kallsyms --all-symbols
       #include <asm/types.h>
       ......
       ......
       .globl kallsyms_token_table
               ALGN
       kallsyms_token_table:
       Segmentation fault (core dumped)
       $
    
    If symbols table is small, all entries in token_profit[0x10000] may
    decrease to 0 after several calls of compress_symbols() in 
optimize_result().
    In that case, find_best_token() always return 0 and
    best_table[i] is set to "\0\0" and best_table_len[i] is set to 2.
    
    As a result, expand_symbol(best_table[0]="\0\0", best_table_len[0]=2, buf)
    in write_src() will run in infinite recursion until stack overflows,
    causing segfault.
    
    This patch checks the find_best_token() return value. If all entries in
    token_profit[0x10000] become 0 according to return value, it breaks the loop
    in optimize_result().
    And expand_symbol() works well when best_table_len[i] is 0.
    
    Signed-off-by: Xiaochen Wang <wangxiaochen0@xxxxxxxxx>
    [Linux: e0a04b11e4059cab033469617 scripts/kallsyms.c: fix potential 
segfault]
    Signed-off-by: Pawel Wieczorkiewicz <wipawel@xxxxxxxxx>
    Reviewed-by: Bjoern Doebel <doebel@xxxxxxxxx>
    Reviewed-by: Norbert Manthey <nmanthey@xxxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/tools/symbols.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/tools/symbols.c b/xen/tools/symbols.c
index 8c5842d43f..05139d1600 100644
--- a/xen/tools/symbols.c
+++ b/xen/tools/symbols.c
@@ -525,6 +525,8 @@ static void optimize_result(void)
 
                        /* find the token with the breates profit value */
                        best = find_best_token();
+                       if (token_profit[best] == 0)
+                               break;
 
                        /* place it in the "best" table */
                        best_table_len[i] = 2;
--
generated by git-patchbot for /home/xen/git/xen.git#staging

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog