[PATCH] sorttable: bound section names by the section name table

[Leizhen Zhang]

do_sort() looks up the sections it needs by name:

	secstrings = (const char *)ehdr + shdr_offset(string_sec);
	...
		idx = shdr_name(shdr);
		if (!strcmp(secstrings + idx, "__ex_table"))

sh_name is a 32-bit offset read from the file and nothing bounds it, so one
section header can point the name anywhere and strcmp() reads from there.

Found by fuzzing the host ELF tools with mutated object files under
ASan/UBSan. Reproducer, setting only sh_name of section 1 in an otherwise
valid vmlinux:

  $ python3 -c 'import struct
  d = bytearray(open("vmlinux","rb").read())
  shoff, = struct.unpack_from("<Q", d, 0x28)
  entsize, = struct.unpack_from("<H", d, 0x3a)
  struct.pack_into("<I", d, shoff + entsize, 0x7ffffff0)
  open("t.elf","wb").write(bytes(d))'

  $ ./sorttable t.elf
  ERROR: AddressSanitizer: SEGV on unknown address 0x7f2555f92911
    #0 in strcmp
    #1 in do_sort scripts/sorttable.c:657

Skip a section whose name offset is outside the name table. Such a section
cannot be one of the four this loop is looking for, so skipping it changes
nothing for a valid object: the reproducer and an unmodified vmlinux now
both print the same "incomplete ORC unwind tables" line and exit 1.

This bounds the index into the table, not the table itself: a name table
whose own sh_offset or sh_size is bogus is a separate gap, and in the
elf_map() path used here there is no mapped size to check it against.

The read predates commit 1091670637be ("scripts/sorttable: Rename
'sortextable' to 'sorttable'"); I could not pin the original commit from a
shallow clone, so there is no Fixes tag.

Assisted-by: LLM ASan UBSan
Signed-off-by: Leizhen Zhang <lzsx618@xxxxxxxxx>
---
 scripts/sorttable.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/sorttable.c b/scripts/sorttable.c
index 88e49a5c4251..2f72a7710a0c 100644
--- a/scripts/sorttable.c
+++ b/scripts/sorttable.c
@@ -619,6 +619,7 @@ static int do_sort(Elf_Ehdr *ehdr,
 	void *sym_start;
 	void *sym_end;
 	const char *secstrings;
+	uint64_t secstrings_size;
 	const char *strtab;
 	char *extab_image;
 	int sort_need_index;
@@ -645,6 +646,7 @@ static int do_sort(Elf_Ehdr *ehdr,
 		shstrndx = shdr_link(shdr_start);
 	string_sec = get_index(shdr_start, shentsize, shstrndx);
 	secstrings = (const char *)ehdr + shdr_offset(string_sec);
+	secstrings_size = shdr_size(string_sec);
 
 	shnum = ehdr_shnum(ehdr);
 	if (shnum == SHN_UNDEF)
@@ -653,7 +655,10 @@ static int do_sort(Elf_Ehdr *ehdr,
 	for (i = 0; i < shnum; i++) {
 		Elf_Shdr *shdr = get_index(shdr_start, shentsize, i);
 
+		/* sh_name is a file-supplied offset into the name table. */
 		idx = shdr_name(shdr);
+		if ((uint32_t)idx >= secstrings_size)
+			continue;
 		if (!strcmp(secstrings + idx, "__ex_table"))
 			extab_sec = shdr;
 		if (!strcmp(secstrings + idx, ".symtab"))
-- 
2.34.1