> diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
> index 1e7635864..9455e3bb0 100644
> --- a/kernel/kallsyms.c
> +++ b/kernel/kallsyms.c
> @@ -423,6 +423,37 @@ int lookup_symbol_name(unsigned long addr, char *symname)
> return lookup_module_symbol_name(addr, symname);
> }
>
> +#ifdef CONFIG_STACKTRACE_BUILD_ID
> +
> +static int append_buildid(char *buffer, const char *modname,
> + const unsigned char *buildid)
> +{
> + if (!modname)
> + return 0;
> +
> + if (!buildid) {
> + pr_warn_once("Undefined buildid for the module %s\n", modname);
> + return 0;
> + }
When ftrace_mod_address_lookup() succeeds in kallsyms_lookup_buildid(),
it sets *modname but doesn't initialize *modbuildid. This leaves the
buildid variable uninitialized when __sprint_symbol() calls
append_buildid(). Can the check above read uninitialized memory?
Looking at kallsyms_lookup_buildid():
- module_address_lookup() properly initializes both modname and
modbuildid
- bpf_address_lookup() sets modname=NULL (so append_buildid isn't
called)
- ftrace_mod_address_lookup() sets modname=mod_map->mod->name but has
no modbuildid parameter
The commit message mentions wanting to catch when lookup functions don't
handle buildid, but shouldn't kallsyms_lookup_buildid() initialize
*modbuildid=NULL before calling the lookup functions to avoid undefined
behavior?
> +
> + /* build ID should match length of sprintf */
> +#ifdef CONFIG_MODULES
> + static_assert(sizeof(typeof_member(struct module, build_id)) == 20);
> +#endif
> +
> + return sprintf(buffer, " %20phN", buildid);
> +}
[ ... ]
> @@ -445,15 +476,8 @@ static int __sprint_symbol(char *buffer, unsigned long
> address,
>
> if (modname) {
> len += sprintf(buffer + len, " [%s", modname);
> -#if IS_ENABLED(CONFIG_STACKTRACE_BUILD_ID)
> - if (add_buildid && buildid) {
> - /* build ID should match length of sprintf */
> -#if IS_ENABLED(CONFIG_MODULES)
> - static_assert(sizeof(typeof_member(struct module,
> build_id)) == 20);
> -#endif
> - len += sprintf(buffer + len, " %20phN", buildid);
> - }
> -#endif
> + if (add_buildid)
> + len += append_buildid(buffer + len, modname, buildid);
> len += sprintf(buffer + len, "]");
> }
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19105560191
