xen/tools/symbols.c: fix potential segfault
authorXiaochen Wang <wangxiaochen0@gmail.com>
Wed, 3 Apr 2019 08:18:20 +0000 (10:18 +0200)
committerJan Beulich <jbeulich@suse.com>
Wed, 3 Apr 2019 08:18:20 +0000 (10:18 +0200)
commitd59e4dadba52b40c4a5f07f18039b42323469672
treef5dd2f817e8082c73113702b7e737e771f9ea42f
parent24469e6a383e32edfb1000550b4a6dcd6416a994
xen/tools/symbols.c: fix potential segfault

Description:
This bug hardly appears during real kernel compiling,
 because the vmlinux symbols table is huge.

But we can still catch it under strict condition , as follows.
   $ echo "c101b97b T do_fork" | ./scripts/kallsyms --all-symbols
   #include <asm/types.h>
   ......
   ......
   .globl kallsyms_token_table
           ALGN
   kallsyms_token_table:
   Segmentation fault (core dumped)
   $

If symbols table is small, all entries in token_profit[0x10000] may
decrease to 0 after several calls of compress_symbols() in optimize_result().
In that case, find_best_token() always return 0 and
best_table[i] is set to "\0\0" and best_table_len[i] is set to 2.

As a result, expand_symbol(best_table[0]="\0\0", best_table_len[0]=2, buf)
in write_src() will run in infinite recursion until stack overflows,
causing segfault.

This patch checks the find_best_token() return value. If all entries in
token_profit[0x10000] become 0 according to return value, it breaks the loop
in optimize_result().
And expand_symbol() works well when best_table_len[i] is 0.

Signed-off-by: Xiaochen Wang <wangxiaochen0@gmail.com>
[Linux: e0a04b11e4059cab033469617 scripts/kallsyms.c: fix potential segfault]
Signed-off-by: Pawel Wieczorkiewicz <wipawel@amazon.de>
Reviewed-by: Bjoern Doebel <doebel@amazon.de>
Reviewed-by: Norbert Manthey <nmanthey@amazon.de>
Acked-by: Jan Beulich <jbeulich@suse.com>
xen/tools/symbols.c