Re: [PATCH 14/15] kallsyms: scripts/kallsyms: Reduce the output file size

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kallsyms: NULL dereference and offset mismatch in write_src() on unused tokens
--

commit 20102d6e3b81d88a59f6ac3b9732c8a7b28d3f98
Author: David Laight <david.laight.linux@gmail.com>

kallsyms: scripts/kallsyms: Reduce the output file size

This commit reduces the size of the assembly output generated by
scripts/kallsyms by formatting byte values in decimal, packing multiple
values per line for kallsyms_token_index and kallsyms_markers, moving the
token tables first, and replacing duplicate symbol name comments with
symbol offsets.

> diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
> index 189fb50ec8c58..8576fe6ad90b7 100644
> --- a/scripts/kallsyms.c
> +++ b/scripts/kallsyms.c
> @@ -350,6 +350,30 @@ static void write_src(void)
>  	struct sym_entry *se;
>  
>  	printf("\t.section .rodata, \"a\"\n");
> +	printf("\n");
> +
> +	output_label("kallsyms_token_table");
> +	off = 0;
> +	for (i = 0; i < 256; i++) {
> +		best_idx[i] = off;
> +		off += token_table[i].len + 1;
> +		printf("\t.asciz\t\"%s\"\t/* %u: %u */\n",
> +		       token_table[i].str, i, token_table[i].refs);
> +	}

[Severity: High]
Can token_table[i].str be NULL here when fewer than 256 tokens are
populated?

During pass 0 of a CONFIG_KALLSYMS=y build, scripts/link-vmlinux.sh runs
scripts/kallsyms on an empty symbol file:

scripts/link-vmlinux.sh:kallsyms_step() {
    ...
    if is_enabled CONFIG_KALLSYMS; then
        true > .tmp_vmlinux0.syms
        kallsyms .tmp_vmlinux0.syms .tmp_vmlinux0.kallsyms
    fi
    ...
}

When symbol_cnt is 0 (or whenever the input symbols do not populate all
256 entries), insert_real_symbols_in_table() leaves token_table[i].str as
NULL and token_table[i].len as 0 for unreferenced tokens:

scripts/kallsyms.c:insert_real_symbols_in_table() {
    ...
    for (i = 0; i <= 255; i++) {
        if (!token_table[i].refs)
            continue;
        token_table[i].len = 1;
        token_table[i].str = xmalloc(2);
        token_table[i].str[0] = i;
        token_table[i].str[1] = 0;
    }
}

In optimize_result(), find_best_token() then returns -1 and breaks out of
the loop before filling the remaining unused tokens.

When write_src() passes token_table[i].str to printf("%s"), isn't that
undefined behavior that segfaults on non-glibc hosts (such as musl)? Also,
on glibc hosts where printf("%s", NULL) outputs "(null)" (7 bytes
including the NUL terminator in .asciz), off is only incremented by
token_table[i].len + 1 (1 byte), which mismatches the actual size emitted
into kallsyms_token_table and corrupts the offsets recorded in best_idx[].

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018155206.132411-1-david.laight.linux@gmail.com?part=14