Messages in this thread | | | Date | Thu, 3 Dec 2009 12:07:02 +0800 | Subject | Re: [PATCH] modpost: fix segfault in sym_is() with prefixed arches | From | Américo Wang <> |
| |
On Thu, Dec 3, 2009 at 11:50 AM, Mike Frysinger <vapier@gentoo.org> wrote: > The sym_is() compares a symbol in an attempt to automatically skip symbol > prefixes. It does this first by searching the real symbol with the normal > unprefixed symbol. But then it uses the length of the original symbol to > check the end of the substring instead of the length of the symbol it is > looking for. On non-prefixed arches, this is effectively the same thing, > so there is no problem. On prefixed-arches, since this is exceeds by just > one byte, a crash is rare and it is usually a NUL byte anyways. But every > once in a blue moon, you get the right page alignment and it segfaults. > > For example, on the Blackfin arch, sym_is() will be called with the real > symbol "___mod_usb_device_table" as "symbol" when looking for the normal > symbol "__mod_usb_device_table" as "name". The substring will thus return > one byte into "symbol" and store it into "match". But then "match" will > be indexed with the length of "symbol" instead of "name" and so we will > exceed the storage. i.e. the code ends up doing: > char foo[] = "abc"; return foo[strlen(foo)+1] == '\0'; > > Signed-off-by: Mike Frysinger <vapier@gentoo.org> > --- > scripts/mod/file2alias.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c > index 40e0045..1ffd1e4 100644 > --- a/scripts/mod/file2alias.c > +++ b/scripts/mod/file2alias.c > @@ -726,7 +726,7 @@ static inline int sym_is(const char *symbol, const char *name) > match = strstr(symbol, name); > if (!match) > return 0; > - return match[strlen(symbol)] == '\0'; > + return match[strlen(name)] == '\0'; > } > > static void do_table(void *symval, unsigned long size,
Nice catch!
Acked-by: WANG Cong <xiyou.wangcong@gmail.com> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |