• Mike Frysinger's avatar
    modpost: fix segfault in sym_is() with prefixed arches · 3a5dd791
    Mike Frysinger authored
    The sym_is() compares a symbol in an attempt to automatically skip symbol
    prefixes.  It does this first by searching the real symbol with the normal
    unprefixed symbol.  But then it uses the length of the original symbol to
    check the end of the substring instead of the length of the symbol it is
    looking for.  On non-prefixed arches, this is effectively the same thing,
    so there is no problem.  On prefixed-arches, since this is exceeds by just
    one byte, a crash is rare and it is usually a NUL byte anyways.  But every
    once in a blue moon, you get the right page alignment and it segfaults.
    
    For example, on the Blackfin arch, sym_is() will be called with the real
    symbol "___mod_usb_device_table" as "symbol" when looking for the normal
    symbol "__mod_usb_device_table" as "name".  The substring will thus return
    one byte into "symbol" and store it into "match".  But then "match" will
    be indexed with the length of "symbol" instead of "name" and so we will
    exceed the storage.  i.e. the code ends up doing:
    	char foo[] = "abc"; return foo[strlen(foo)+1] == '\0';
    Signed-off-by: default avatarMike Frysinger <vapier@gentoo.org>
    Signed-off-by: default avatarRusty Russell <rusty@rustcorp.com.au>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    3a5dd791
file2alias.c 28.1 KB