A maximum length symbol can be KSYM_NAME_LEN long (including the '\0'). But the name being compressed contains a leading symbol type (e.g. T). So when the compressed name is expanded (after the hex is written out) the buffer needs to be KSYM_NAME_LEN+1 bytes long to allow to both the symbol type and the '\0'. But it is declared 'char buf[KSYM_NAME_LEN] so a maximal length name overwrites something on stack. Found by code inspection, seems to have been broken before the code was imported into git. I expect there aren't any maximal length symbols and/or the byte that is overwritten is something that is either zero or 'don't care'. Signed-off-by: David Laight --- Unchanged from v2. scripts/kallsyms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/kallsyms.c b/scripts/kallsyms.c index ecb444078c1c..140e888bf713 100644 --- a/scripts/kallsyms.c +++ b/scripts/kallsyms.c @@ -398,7 +398,7 @@ static void write_src(FILE *out_bin_file, const char *out_bin_name) unsigned int best_idx[256]; unsigned int *markers, markers_cnt; long bin_start; - char buf[KSYM_NAME_LEN]; + char buf[1 + KSYM_NAME_LEN]; printf("\t.section .rodata, \"a\"\n"); -- 2.39.5