[PATCH 0/2] tools/symbols: fix oversized names and token expansion

[Mykola Kvach <mykola_kvach@xxxxxxxx>]

Hi all,

This short series fixes two bugs in the build-time symbol table
generator (xen/tools/symbols). Both are host tool bugs; the runtime
code is not changed.

At runtime, symbol names are expanded into buffers of KSYM_NAME_LEN + 1
bytes (128). The generator did not check that the names it puts into the
table fit into these buffers.

Patch 1 fixes the first bug. In SYSV input, local symbols are prefixed
with the source file name ("filename#symbol"). A long absolute build
path can therefore create a name longer than 127 bytes, even when the
symbol itself is short. A debug Xen build on an Orange Pi 5 (RK3588S)
crashed during the boot self-tests: symbols_lookup_by_name() expanded
such a name into its 128-byte buffer and overwrote the saved frame
pointer and return address. The patch rejects retained names longer than
KSYM_NAME_LEN during the build and prints the offending name.
Readable --xensyms maps are not restricted. Nothing changes for names
of at most 127 bytes.

A build from a long absolute source path can now fail at link time.
On x86, in-tree builds use relative paths and are not affected. An
out-of-tree build with the default config fails if the absolute path of
xen/ is longer than 78 bytes; the longest such name is
kexec_reloc.S#compatibility_mode.

Patch 2 fixes the second bug. In the compressed stream, each symbol is
stored as [type][name]. A compression token can therefore expand to
the type byte plus a full 127-byte name (128 bytes), and write_src()
adds a terminating NUL. Its local buffer was 128 bytes, one byte too
small. The patch allocates KSYM_NAME_LEN + 2 bytes (type + name +
NUL). This bug can trigger with fully valid names, but only with a very
small symbol table; real symbol tables do not hit it. The new size
relies on the name limit from patch 1.

Mykola Kvach (2):
  tools/symbols: reject names exceeding the runtime limit
  tools/symbols: leave room for the type byte and NUL when expanding
    tokens

 xen/tools/symbols.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

-- 
2.53.0