From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 508C844AB60; Tue, 21 Jul 2026 22:45:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784673939; cv=none; b=XFq1XbPYZi7wUOH3IFGQjlQXj2Ix+5ey7AYpLzOvn1LlDBGLdkVNE+VzKNPKEhQHNKp85FTFAGdVCJK/pMmuQOfQmHRcNB63pXNmZ8fX0hKM9dxWyPTjboEqmWZCCJZCLr8xxi22CgsnRPnNFp5yvxHy7FzMtGX0mC3NoAcbc3U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784673939; c=relaxed/simple; bh=PZOMurkUkLE1Qxd0q8xFGtAi770pHsKBewJtV4JVUFE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ObXHYkVfaxS8BIihpmABJlWEwHa6WhK/zRzLvasyOMdiKNqVpwdm/reB3VxNXvIzMQdNU8t3wd3We6hAAyePn464cMCK7AivoS/z2+cysZafDuufG91mO1ygC9x2ELPsl2CGRk5xhsZ/g0tf68UA++44RxqhgBchRWGsRTe8bQo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=a/bQYadb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="a/bQYadb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B78BB1F000E9; Tue, 21 Jul 2026 22:45:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784673938; bh=hyI/iesxqNAqmQPUa1LWuLgVBVPanDssG4xXnCuDzvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=a/bQYadb0GQy6bpmJPcnOg/+ick6DFecijxlitU2g6f9/Uhwov3XiKBu3cs6Yoqsl IQvKK2RGntIMEuNkRafdcW3eOmDfpheHCnZl1/LXuxmxvNsRLigqqQe+0xyA0h3RFv bq5/BnBcnzhYR5U5WVmDPbix5fxIfpbHVmmoD1FY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-bot , Namhyung Kim , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 5.10 315/699] perf symbols: Bounds-check .gnu_debuglink section data Date: Tue, 21 Jul 2026 17:21:14 +0200 Message-ID: <20260721152402.799960841@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152355.667394603@linuxfoundation.org> References: <20260721152355.667394603@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnaldo Carvalho de Melo [ Upstream commit 9c74f0aab398cb32ab250401f323c0fdc9a3a496 ] filename__read_debuglink() copies .gnu_debuglink section data into a caller-provided buffer via: strncpy(debuglink, data->d_buf, size); where size is PATH_MAX. If the ELF section is smaller than size and lacks a null terminator, strncpy reads past data->d_buf into adjacent memory. A malformed ELF file can trigger this, potentially causing a segfault or leaking heap data. Additionally, strncpy does not guarantee null termination when the source fills the buffer. Replace with an explicit memcpy bounded by both the output buffer size and the actual section data size (data->d_size), followed by explicit null termination. Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c") Reported-by: sashiko-bot Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin --- tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c index 907796a4699282..2ebceeff87c6f4 100644 --- a/tools/perf/util/symbol-elf.c +++ b/tools/perf/util/symbol-elf.c @@ -753,7 +753,14 @@ int filename__read_debuglink(const char *filename, char *debuglink, goto out_elf_end; /* the start of this section is a zero-terminated string */ - strncpy(debuglink, data->d_buf, size); + if (data->d_size > 0) { + size_t len = min(size - 1, data->d_size); + + memcpy(debuglink, data->d_buf, len); + debuglink[len] = '\0'; + } else { + debuglink[0] = '\0'; + } err = 0; -- 2.53.0