From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A24A35DA40; Tue, 21 Jul 2026 19:37:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784662632; cv=none; b=r0oH/SoS4ruZl2SSUSIudwEGrrGiaix1jluc7kSFIKYc4BmYCfcVUNrKYZUoCgBiLvad+lB3fMsGj4XItz9Xhzner2kabd+KmRYFAk27/JSf1PPTeRAfRwwlREACKkflC/ZKXPcfuE0uRvdmhHNyQBfUT+TmYW32OG1ZSuZnQwk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784662632; c=relaxed/simple; bh=S9A7szkTpglBhjybAzsBLDC8WGSo2W/+z+dVavol8dw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LhWiYUYXEsbmvRMzBM809JawXjJBsn+q5RNYZLoogRiXb+DGXDaFgDzywQp2kYuya2+Al1peT1RbgPGS4WXmkT3svvQftLX3A5y1VdSokuOCb7tlD+6xvD02k73XDAmtr/KZz+qICe46MtfEz8IrPNBfPVaj1V3EGiEeU1ocwa0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=aU9OFkuk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="aU9OFkuk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9CF21F00A3D; Tue, 21 Jul 2026 19:37:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784662631; bh=bgvG/w/bNb+8mj69zwelX69gdvAC35e4rnSUmRD7VqA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=aU9OFkukMvdgZivgHQwbnL3D2pLTSpaTuC9Tgjz9XcQFBarTZKdJ0heXz9+Vub6dk Jc3NelP5WUdHC18YjIi0fxD48amdBJEfGNfxlHO+GFZBc6DzCXKFy34mDNBRKMQgU8 pxtP6BkxrZCRhJxzxIEoUHM2rWo5z4u9sRJVEWkI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-bot , Namhyung Kim , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 6.12 0519/1276] perf symbols: Bounds-check .gnu_debuglink section data Date: Tue, 21 Jul 2026 17:16:02 +0200 Message-ID: <20260721152457.728985606@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152446.065700225@linuxfoundation.org> References: <20260721152446.065700225@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnaldo Carvalho de Melo [ Upstream commit 9c74f0aab398cb32ab250401f323c0fdc9a3a496 ] filename__read_debuglink() copies .gnu_debuglink section data into a caller-provided buffer via: strncpy(debuglink, data->d_buf, size); where size is PATH_MAX. If the ELF section is smaller than size and lacks a null terminator, strncpy reads past data->d_buf into adjacent memory. A malformed ELF file can trigger this, potentially causing a segfault or leaking heap data. Additionally, strncpy does not guarantee null termination when the source fills the buffer. Replace with an explicit memcpy bounded by both the output buffer size and the actual section data size (data->d_size), followed by explicit null termination. Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c") Reported-by: sashiko-bot Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin --- tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c index 3968645e1dfa08..923e7d1d8aad8a 100644 --- a/tools/perf/util/symbol-elf.c +++ b/tools/perf/util/symbol-elf.c @@ -1160,7 +1160,14 @@ int filename__read_debuglink(const char *filename, char *debuglink, goto out_elf_end; /* the start of this section is a zero-terminated string */ - strncpy(debuglink, data->d_buf, size); + if (data->d_size > 0) { + size_t len = min(size - 1, data->d_size); + + memcpy(debuglink, data->d_buf, len); + debuglink[len] = '\0'; + } else { + debuglink[0] = '\0'; + } err = 0; -- 2.53.0