[PATCH kexec-tools] util_lib/elf_info: bound VMCOREINFO string comparisons

[PATCH kexec-tools] util_lib/elf_info: bound VMCOREINFO string comparisons

[Serapheim Dimitropoulos]

From: Serapheim Dimitropoulos <sdimitropoulos@coreweave.com>

scan_vmcoreinfo() terminates each VMCOREINFO line before matching
known field prefixes. Most fields nevertheless use memcmp() with the
full prefix length, so a short line near the end of the note can make
the comparison read beyond the allocated note buffer. AddressSanitizer
reports a 24-byte read immediately past the allocation in this case.

Use strncmp() for the terminated VMCOREINFO lines and in the arm64
VMCOREINFO hook. Check the ELF note name length before comparing it,
and ignore an empty VMCOREINFO descriptor.

Fixes: f4ce0706d957 ("util_lib: Add functionality to read elf notes")
Signed-off-by: Serapheim Dimitropoulos <sdimitropoulos@coreweave.com>
---
AddressSanitizer found this while running vmcore-dmesg against a minimal
arm64 ELF core. A two-byte VMCOREINFO descriptor containing "X\n" makes
scan_vmcoreinfo() request a 24-byte comparison from the final four bytes
of the 28-byte PT_NOTE allocation. ASan reports the read at
scan_vmcoreinfo(), with the allocation originating in scan_notes().

Before this patch the reproducer aborts with:

  ERROR: AddressSanitizer: heap-buffer-overflow
  READ of size 24
  0 bytes after 28-byte region

After the patch, the reproducer completes without a sanitizer report.
Empty VMCOREINFO descriptors and undersized note names were also tested.
A valid synthetic legacy vmcore exits successfully and produces the
expected output byte-for-byte.

The patch was tested on arm64 Ubuntu 24.04 with AddressSanitizer and with
make distcheck.
---
 kexec/arch/arm64/kexec-arm64.c |  2 +-
 util_lib/elf_info.c            | 78 +++++++++++++++++++++++-------------------
 2 files changed, 43 insertions(+), 37 deletions(-)

diff --git a/kexec/arch/arm64/kexec-arm64.c b/kexec/arch/arm64/kexec-arm64.c
index 58256cf..d401550 100644
--- a/kexec/arch/arm64/kexec-arm64.c
+++ b/kexec/arch/arm64/kexec-arm64.c
@@ -976,7 +976,7 @@ static void arm64_scan_vmcoreinfo(char *pos)
 	const char *str;
 
 	str = "NUMBER(VA_BITS)=";
-	if (memcmp(str, pos, strlen(str)) == 0)
+	if (strncmp(str, pos, strlen(str)) == 0)
 		va_bits = strtoul(pos + strlen(str), NULL, 10);
 }
 
diff --git a/util_lib/elf_info.c b/util_lib/elf_info.c
index d6e5ffc..cfbbea3 100644
--- a/util_lib/elf_info.c
+++ b/util_lib/elf_info.c
@@ -349,12 +349,16 @@ void (*arch_scan_vmcoreinfo)(char *pos);
 
 void scan_vmcoreinfo(char *start, size_t size)
 {
-	char *last = start + size - 1;
+	char *last;
 	char *pos, *eol;
 	char temp_buf[1024];
 	bool last_line = false;
 	char *str;
 
+	if (!size)
+		return;
+	last = start + size - 1;
+
 #define SYMBOL(sym) {					\
 	.str = "SYMBOL(" #sym  ")=",			\
 	.name = #sym,					\
@@ -426,170 +430,170 @@ void scan_vmcoreinfo(char *start, size_t size)
 		}
 
 		str = "SIZE(printk_ringbuffer)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_ringbuffer_sz = strtoull(pos + strlen(str),
 							NULL, 10);
 
 		str = "SIZE(prb_desc)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_sz = strtoull(pos + strlen(str), NULL, 10);
 
 		str = "SIZE(printk_info)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_info_sz = strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_ringbuffer.desc_ring)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_ringbuffer_desc_ring_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_ringbuffer.text_data_ring)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_ringbuffer_text_data_ring_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc_ring.count_bits)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_ring_count_bits_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc_ring.descs)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_ring_descs_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc_ring.infos)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_ring_infos_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_data_ring.size_bits)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_data_ring_size_bits_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_data_ring.data)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_data_ring_data_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc_ring.head_id)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_ring_head_id_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc_ring.tail_id)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_ring_tail_id_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(atomic_long_t.counter)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			atomic_long_t_counter_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc.state_var)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_state_var_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc.info)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_info_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_desc.text_blk_lpos)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_desc_text_blk_lpos_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_data_blk_lpos.begin)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_data_blk_lpos_begin_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(prb_data_blk_lpos.next)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			prb_data_blk_lpos_next_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_info.seq)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_info_seq_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_info.caller_id)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_info_caller_id_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_info.ts_nsec)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_info_ts_nsec_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_info.level)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_info_level_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_info.text_len)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			printk_info_text_len_offset =
 				strtoull(pos + strlen(str), NULL, 10);
 
 		/* Check for "SIZE(printk_log)" or older "SIZE(log)=" */
 		str = "SIZE(log)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_sz = strtoull(pos + strlen(str), NULL, 10);
 
 		str = "SIZE(printk_log)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_sz = strtoull(pos + strlen(str), NULL, 10);
 
 		/* Check for struct printk_log (or older log) field offsets */
 		str = "OFFSET(log.ts_nsec)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_offset_ts_nsec = strtoull(pos + strlen(str), NULL,
 							10);
 		str = "OFFSET(printk_log.ts_nsec)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_offset_ts_nsec = strtoull(pos + strlen(str), NULL,
 							10);
 
 		str = "OFFSET(log.len)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_offset_len = strtoul(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(printk_log.len)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_offset_len = strtoul(pos + strlen(str), NULL, 10);
 
 		str = "OFFSET(log.text_len)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_offset_text_len = strtoul(pos + strlen(str), NULL,
 							10);
 		str = "OFFSET(printk_log.text_len)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			log_offset_text_len = strtoul(pos + strlen(str), NULL,
 							10);
 
 		/* Check for PHYS_OFFSET number */
 		str = "NUMBER(PHYS_OFFSET)=";
-		if (memcmp(str, pos, strlen(str)) == 0) {
+		if (strncmp(str, pos, strlen(str)) == 0) {
 			if (parse_phys_offset(str, pos) != 0)
 				break;
 		}
 
 		/* Check for PHYS_OFFSET number on some arch it called phys_ram_base*/
 		str = "NUMBER(phys_ram_base)=";
-		if (memcmp(str, pos, strlen(str)) == 0) {
+		if (strncmp(str, pos, strlen(str)) == 0) {
 			if (parse_phys_offset(str, pos) != 0)
 				break;
 		}
 
 		str = "NUMBER(PAGE_OFFSET)=";
-		if (memcmp(str, pos, strlen(str)) == 0)
+		if (strncmp(str, pos, strlen(str)) == 0)
 			page_offset = strtoull(pos + strlen(str), NULL, 16);
 
 		if (arch_scan_vmcoreinfo != NULL)
@@ -644,7 +648,9 @@ static int scan_notes(int fd, loff_t start, loff_t lsize)
 		if (next > (last + 1))
 			break;
 
-		if ((memcmp(n_name, "VMCOREINFO", 11) != 0) || (n_type != 0))
+		if (n_namesz < sizeof("VMCOREINFO") ||
+		    memcmp(n_name, "VMCOREINFO", sizeof("VMCOREINFO")) != 0 ||
+		    n_type != 0)
 			continue;
 		scan_vmcoreinfo(n_desc, n_descsz);
 	}

---
base-commit: 43c5cba85ad23cc69c423527d9587c59b89fa437
change-id: 20260911-codex-vmcoreinfo-bounds-mailtest-026976207438

Best regards,
-- 
Serapheim Dimitropoulos <sdimitropoulos@coreweave.com>

Re: [PATCH kexec-tools] util_lib/elf_info: bound VMCOREINFO string comparisons

[Simon Horman]

On Fri, Sep 11, 2026 at 10:23:51AM -0400, Serapheim Dimitropoulos wrote:
> From: Serapheim Dimitropoulos <sdimitropoulos@coreweave.com>
> 
> scan_vmcoreinfo() terminates each VMCOREINFO line before matching
> known field prefixes. Most fields nevertheless use memcmp() with the
> full prefix length, so a short line near the end of the note can make
> the comparison read beyond the allocated note buffer. AddressSanitizer
> reports a 24-byte read immediately past the allocation in this case.
> 
> Use strncmp() for the terminated VMCOREINFO lines and in the arm64
> VMCOREINFO hook. Check the ELF note name length before comparing it,
> and ignore an empty VMCOREINFO descriptor.
> 
> Fixes: f4ce0706d957 ("util_lib: Add functionality to read elf notes")
> Signed-off-by: Serapheim Dimitropoulos <sdimitropoulos@coreweave.com>
> ---
> AddressSanitizer found this while running vmcore-dmesg against a minimal
> arm64 ELF core. A two-byte VMCOREINFO descriptor containing "X\n" makes
> scan_vmcoreinfo() request a 24-byte comparison from the final four bytes
> of the 28-byte PT_NOTE allocation. ASan reports the read at
> scan_vmcoreinfo(), with the allocation originating in scan_notes().
> 
> Before this patch the reproducer aborts with:
> 
>   ERROR: AddressSanitizer: heap-buffer-overflow
>   READ of size 24
>   0 bytes after 28-byte region
> 
> After the patch, the reproducer completes without a sanitizer report.
> Empty VMCOREINFO descriptors and undersized note names were also tested.
> A valid synthetic legacy vmcore exits successfully and produces the
> expected output byte-for-byte.
> 
> The patch was tested on arm64 Ubuntu 24.04 with AddressSanitizer and with
> make distcheck.

Thanks, applied.
Sorry for the delay.

- util_lib/elf_info: bound VMCOREINFO string comparisons
  https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/commit/?id=0fd0d8e9ea97