]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf symbols: Add bounds checks to elf_read_build_id() note iteration
authorArnaldo Carvalho de Melo <acme@redhat.com>
Mon, 8 Jun 2026 11:12:34 +0000 (08:12 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 10 Jun 2026 21:56:02 +0000 (18:56 -0300)
commitacc56d3941fc2997a5a21ea9233a8ac3d87c4f2f
tree5f0e7c8202ef690b6337bed7b6880d36499aba98
parenta0e4362a3e7b592f1d58949ffe3d6decad39a17c
perf symbols: Add bounds checks to elf_read_build_id() note iteration

elf_read_build_id() iterates ELF notes using pointer arithmetic
driven by n_namesz and n_descsz from the note headers.  Neither
the note header read nor the subsequent name/desc advances are
checked against the section boundary.  A malformed ELF file with
oversized note sizes causes out-of-bounds reads past the section
data buffer.

Add two bounds checks: verify the note header fits within the
remaining section data, and verify that namesz + descsz (after
alignment) fits before advancing the pointer.

Fixes: fd7a346ea292074e ("perf symbols: Filename__read_build_id should look at .notes section too")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/symbol-elf.c