Re: [PATCH v2 next 11/15] kallsyms: scripts/kallsyms: Keep full expansion of tokens

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] kallsyms: NULL token_table[].str passed to printf() in write_src()
--

commit b464b94e58431a4ad1ec112c739d63f16547b8f2
Author: David Laight <david.laight.linux@gmail.com>

kallsyms: scripts/kallsyms: Keep full expansion of tokens

This commit stores the full NUL-terminated string expansion for each token
in token_table[] as tokens are allocated, avoiding recursive symbol
expansions later.

> diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c
> index 5603b2a6c77bd..9e1bc0fdaa9f2 100644
> --- a/scripts/kallsyms.c
> +++ b/scripts/kallsyms.c
[ ... ]
> @@ -415,9 +403,8 @@ static void write_src(void)
>  	off = 0;
>  	for (i = 0; i < 256; i++) {
>  		best_idx[i] = off;
> -		expand_symbol(token_table[i].ch, token_table[i].len, buf);
> -		printf("\t.asciz\t\"%s\"\n", buf);
> -		off += strlen(buf) + 1;
> +		off += token_table[i].len + 1;
> +		printf("\t.asciz\t\"%s\"\n", token_table[i].str);
>  	}
>  	printf(".size kallsyms_token_table, . - kallsyms_token_table\n");
>  	printf("\n");

[Severity: High]
Can token_table[i].str be NULL here when some token slots remain unused?

In insert_real_symbols_in_table(), token_table[i].str is only allocated for
character codes present in the input symbols:

	for (i = 0; i <= 255; i++) {
		if (!token_table[i].len)
			continue;
		token_table[i].str = xmalloc(2);
		token_table[i].str[0] = i;
		token_table[i].str[1] = 0;
	}

Then in optimize_result(), the loop stops early as soon as find_best_token()
finds no remaining token pairs with positive profit:

		best = find_best_token();
		if (best < 0)
			break;

Any remaining unused entries in token_table[] keep len == 0 and str == NULL.
During pass 0 in scripts/link-vmlinux.sh, kallsyms is invoked on an empty
symbol file (.tmp_vmlinux0.syms), leaving all 256 token_table[i].str
pointers as NULL.

Previously, expand_symbol() wrote an empty string into buf when len was 0.
Passing a NULL token_table[i].str to printf("%s") in write_src() causes a
segmentation fault on non-glibc hosts (such as musl) or prints "(null)" on
glibc hosts while advancing off by only 1 byte, which corrupts
kallsyms_token_table and best_idx[].

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018155206.132411-1-david.laight.linux@gmail.com?part=11