Created attachment 270791 [details] patch Hi All of my pkcs11 libraries are broken after 2574974648c68c738aec3ff96644d888d7913a37 (D56999). See: https://github.com/openssh/openssh-portable/commit/3ca274e44cb2c2351376fc14e4c3e92ba4a8f87b ``` % ssh-agent -d -a /tmp/agent.socket SSH_AUTH_SOCK=/tmp/agent.socket; export SSH_AUTH_SOCK; echo Agent pid 15732; ... debug3: process_add: add /usr/local/lib/libpcsclite.so.1 lib_contains_symbol: nlist failed for /usr/local/lib/libpcsclite.so.1 provider /usr/local/lib/libpcsclite.so.1 is not a PKCS11 library debug3: pkcs11_add_provider: response 5 debug1: pkcs11_add_provider: no keys; terminate helper debug3: helper_terminate: terminating helper for /usr/local/lib/libpcsclite.so.1; remaining 0 keys ``` Same for opensc and libykcs11.so (yubikey): ``` debug3: process_add: add /usr/local/lib/libykcs11.so.2.7.2 lib_contains_symbol: nlist failed for /usr/local/lib/libykcs11.so.2.7.2 provider /usr/local/lib/libykcs11.so.2.7.2 is not a PKCS11 library debug3: pkcs11_add_provider: response 5 debug1: pkcs11_add_provider: no keys; terminate helper ``` After reverting 3ca274e in openssh by the patch attached: ``` debug3: pkcs11_start_helper: helper 1 for "/usr/local/lib/libykcs11.so.2.7.2" on fd 6 pid 61042 debug3: pkcs11_add_provider: add /usr/local/lib/libykcs11.so.2.7.2 debug1: pkcs11_start_helper: starting /usr/local/libexec/ssh-pkcs11-helper -vvv debug3: pkcs11_init: called, interactive = 0 debug1: process_add debug3: process_add: add /usr/local/lib/libykcs11.so.2.7.2 debug1: provider /usr/local/lib/libykcs11.so.2.7.2: manufacturerID <Yubico (www.yubico.com)> cryptokiVersion 2.40 libraryDescription <PKCS#11 PIV Library (SP-800-73)> libraryVersion 2.72 ```
Created attachment 270792 [details] openssh-portable workaround workaround for openssh-portable
Comment on attachment 270791 [details] patch >From b7c1fd64834e9417de99f97fb53f586518b0da4a Mon Sep 17 00:00:00 2001 >From: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org> >Date: Sat, 16 May 2026 20:31:14 +0330 >Subject: [PATCH] openssh: Fix nlist function > >--- > crypto/openssh/misc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/crypto/openssh/misc.c b/crypto/openssh/misc.c >index ed3e9d31425c..3e9dad4172ae 100644 >--- a/crypto/openssh/misc.c >+++ b/crypto/openssh/misc.c >@@ -3130,7 +3130,7 @@ ptimeout_isset(struct timespec *pt) > int > lib_contains_symbol(const char *path, const char *s) > { >-#ifdef HAVE_NLIST >+#ifdef HAVE_NLIST_H > struct nlist nl[2]; > int ret = -1, r; > >-- >2.54.0 >
Comment on attachment 270792 [details] openssh-portable workaround Oops, I accidentally disabled the nlist header with a typo in my patch: HAVE_NLIST_H -> HAVE_NLIST_N. Then I tried to fix it inline, but Bugzilla posted it instead of updating it. :) My patch doesn't work. but the issue exists, I can fix (as a tmp workaround) it by disabling `HAVE_NLIST` header. Let met see what is the underlying issue...
It seems the lib_contains_symbol function fails to verify the existence of the C_GetFunctionList symbol using nlist(3) in PKCS11 libraries. % grep -A2 C_GetFunctionList crypto/openssh/ssh-pkcs11.c if (lib_contains_symbol(provider_id, "C_GetFunctionList") != 0) { error("provider %s is not a PKCS11 library", provider_id); goto fail; But I can see it exists: ``` elfdump -s /usr/local/lib/libykcs11.so | grep -A4 -B1 C_GetFunctionList entry: 240 st_name: C_GetFunctionList st_value: 0x136e0 st_size: 157 st_info: STT_FUNC STB_GLOBAL st_shndx: 13 ```
The change you claim is responsible came in with 644b4646c7aca, not 2574974648c68. Furthermore, crypto/openssh/config.h defines both HAVE_NLIST and HAVE_NLIST_H, so that particular change is a nop. I would suggest trying something like ktrace -di env LD_UTRACE=1 ssh-agent -d -a /tmp/agent.socket followed by kdump -tu
The bug has been reported to openssh: https://bugzilla.mindrot.org/show_bug.cgi?id=3963
(In reply to Dag-Erling Smørgrav from comment #5) Yes, I was patching it with HAVE_NLIST_N, which was a typo, and since it didn't exist, it was disabling the nlist(3) part. That's why it initially worked for me. Done: 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c03008 @ 0x84518f65000 - 0x84518f72fff (/usr/libexec/ssh-pkcs11-helper) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x3c68bc2e0fb0 @ 0x3c68bc2c1000 - 0x3c68bc2e1fff (/libexec/ld-elf.so.1) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c03408 @ 0x84d39fd6000 - 0x84d39fd62e5 ([vdso]) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c03c08 @ 0x84d3d000000 - 0x84d3d5fbfff (/lib/libcrypto.so.35) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c09008 @ 0x84d3b9db000 - 0x84d3ba8bfff (/usr/lib/libprivatessh.so.5) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c09408 @ 0x84d3bc3f000 - 0x84d3bf56fff (/lib/libc.so.7) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c09808 @ 0x84d3b29e000 - 0x84d3b2cbfff (/lib/libthr.so.3) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c09c08 @ 0x84d3c244000 - 0x84d3c2b1fff (/usr/lib/libprivateldns.so.5) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c0a008 @ 0x84d3ad5f000 - 0x84d3ad69fff (/lib/libcrypt.so.5) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c0a408 @ 0x84d3e34b000 - 0x84d3e366fff (/lib/libz.so.6) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c0a808 @ 0x84d3ff72000 - 0x84d3ff8ffff (/lib/libsys.so.7) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c0ac08 @ 0x84d3efc2000 - 0x84d3f0c1fff (/usr/lib/libssl.so.35) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c0b008 @ 0x84d40c7a000 - 0x84d40c9afff (/lib/libmd.so.7) 90116 ssh-pkcs11-helper USER 0x247ef3c0a808 = dlopen(libsys.so.7) ref 1 90116 ssh-pkcs11-helper USER 0x247ef3c0a808 = dlopen(libsys.so.7) ref 2 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3ff8d61c for 0x247ef3c0a808 (/lib/libsys.so.7) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3be25c7c for 0x247ef3c09408 (/lib/libc.so.7) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3bd84c30 for 0x247ef3c09408 (/lib/libc.so.7) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3bd04830 for 0x247ef3c09408 (/lib/libc.so.7) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3bdcb170 for 0x247ef3c09408 (/lib/libc.so.7) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3b2bc9fc for 0x247ef3c09808 (/lib/libthr.so.3) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3b2b05a0 for 0x247ef3c09808 (/lib/libthr.so.3) 90116 ssh-pkcs11-helper USER RTLD: error: Invalid shared object handle 0x84d3b2bffb0 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3e363f9c for 0x247ef3c0a408 (/lib/libz.so.6) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d40c97c2c for 0x247ef3c0b008 (/lib/libmd.so.7) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3ad6765c for 0x247ef3c0a008 (/lib/libcrypt.so.5) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3d0f67a0 for 0x247ef3c03c08 (/lib/libcrypto.so.35) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3efe6638 for 0x247ef3c0ac08 (/usr/lib/libssl.so.35) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3c2a69cc for 0x247ef3c09c08 (/usr/lib/libprivateldns.so.5) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d3b9f4520 for 0x247ef3c09008 (/usr/lib/libprivatessh.so.5) 90116 ssh-pkcs11-helper USER RTLD: init 0x84518f67ef8 for 0x247ef3c03008 (/usr/libexec/ssh-pkcs11-helper) 90116 ssh-pkcs11-helper USER dlopen(/lib/libcrypto.so.35, RTLD_NOW) 90116 ssh-pkcs11-helper USER 0x247ef3c03c08 = dlopen(/lib/libcrypto.so.35) ref 1 90116 ssh-pkcs11-helper USER dlopen(/usr/local/lib/engines/pkcs11.so, RTLD_NOW) 90116 ssh-pkcs11-helper USER RTLD: loaded 0x247ef3c0b808 @ 0x84d42307000 - 0x84d42324fff (/usr/local/lib/engines/pkcs11.so) 90116 ssh-pkcs11-helper USER 0x247ef3c0b808 = dlopen(/usr/local/lib/engines/pkcs11.so) ref 1 90116 ssh-pkcs11-helper USER RTLD: init 0x84d4232016c for 0x247ef3c0b808 (/usr/local/lib/engines/pkcs11.so) 90116 ssh-pkcs11-helper USER RTLD: init 0x84d4231fcc0 for 0x247ef3c0b808 (/usr/local/lib/engines/pkcs11.so) 90116 ssh-pkcs11-helper USER RTLD: dlsym(0x247ef3c0b808, bind_engine) 90116 ssh-pkcs11-helper USER RTLD: 0x84d42312000 = dlsym(0x247ef3c0b808, bind_engine) 90116 ssh-pkcs11-helper USER RTLD: dlsym(0x247ef3c0b808, v_check) 90116 ssh-pkcs11-helper USER RTLD: 0x84d42311fe0 = dlsym(0x247ef3c0b808, v_check) 90116 ssh-pkcs11-helper USER RTLD: dlsym(0x247ef3c0b808, EVP_PKEY_base_id) 90116 ssh-pkcs11-helper USER RTLD: error: Undefined symbol "EVP_PKEY_base_id" 90116 ssh-pkcs11-helper USER RTLD: 0x0 = dlsym(0x247ef3c0b808, EVP_PKEY_base_id)
You need to recompile whichever port provides /usr/local/lib/engines/pkcs11.so. It is failing to load because EVP_PKEY_base_id, which was a function in older versions of OpenSSL, is now a macro.
Hmm I may be mistaken, it looks like OpenSSL itself looks for EVP_PKEY_base_id to check if an engine was compiled for an older version. I'll do a little more digging.
(In reply to Dag-Erling Smørgrav from comment #8) Thank you for your time. Unfortunately, it didn't helped. ``` % pkg info -l libp11 | grep engin /usr/local/lib/engines/libpkcs11.so /usr/local/lib/engines/pkcs11.so % cd /usr/ports/security/libp11 % mdo make clean % mdo make % mdo make deinstall && mdo make install ``` + I did a cleanworld + buildworld + installworld without CCACHE to make sure... I also suspected openssl and rebuild openssh-portable with DEFAULT_VERSIONS+=ssl=openssl36. It didn't helped either.
(In reply to Dag-Erling Smørgrav from comment #9) FYI, for now, I removed the library validation as a workaround to continue my work. ``` diff --git a/crypto/openssh/ssh-pkcs11.c b/crypto/openssh/ssh-pkcs11.c index 7a7d3b8eaa0a..93671e123643 100644 --- a/crypto/openssh/ssh-pkcs11.c +++ b/crypto/openssh/ssh-pkcs11.c @@ -1873,10 +1873,6 @@ pkcs11_register_provider(char *provider_id, char *pin, debug_f("provider already registered: %s", provider_id); goto fail; } - if (lib_contains_symbol(provider_id, "C_GetFunctionList") != 0) { - error("provider %s is not a PKCS11 library", provider_id); - goto fail; - } /* open shared pkcs11-library */ if ((handle = dlopen(provider_id, RTLD_NOW)) == NULL) { ``` + make -C secure clean && make -C secure && make -C secure install Works for now. (disabling HAVE_NLIST works too). It may give your a clue, but its not urgent for me for now.
OK this is a bug in our nlist(3). It is looking for a SHT_SYMTAB section, which does not exist in libykcs11.so. It should be looking for both SHT_SYMTAB and SHT_DYNSYM.
Independent of what we want to do with nlist(3) we can use openssh's fallback implementation in lib_contains_symbol by undefining HAVE_NLIST, e.g. diff --git a/crypto/openssh/config.h b/crypto/openssh/config.h index 69bc79c92bb5..9c96998c1512 100644 --- a/crypto/openssh/config.h +++ b/crypto/openssh/config.h @@ -1032,10 +1032,10 @@ /* #undef HAVE_NGETADDRINFO */ /* Define to 1 if you have the 'nlist' function. */ -#define HAVE_NLIST 1 +/* #undef HAVE_NLIST */ /* Define to 1 if you have the <nlist.h> header file. */ -#define HAVE_NLIST_H 1 +/* #undef HAVE_NLIST_H */ /* Define to 1 if you have the 'nl_langinfo' function. */ #define HAVE_NL_LANGINFO 1
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=4617a6cb82a673b02257257c1f5f8a3c8d2bb943 commit 4617a6cb82a673b02257257c1f5f8a3c8d2bb943 Author: Dag-Erling Smørgrav <des@FreeBSD.org> AuthorDate: 2026-05-19 06:52:53 +0000 Commit: Dag-Erling Smørgrav <des@FreeBSD.org> CommitDate: 2026-05-19 06:53:35 +0000 nlist: Handle multiple symbol tables * Instead of looking for and stopping at the first SHT_SYMTAB section, iterate over all SHT_DYNSYM and SHT_SYMTAB sections until we've either found all our symbols or run out. * Perform bounds checks on section and string table offsets and sizes before attempting to mmap() the string table. * Perform bounds checks on individual symbol table entries before attempting to access the corresponding strings. * Stop treating _Foo and Foo as the same symbol. This unbreaks OpenSSH which uses nlist(3) to verify PKCS#11 providers. PR: 295336 MFC after: 1 week Fixes: 77909f597881 ("Initial elf nlist support [...]") Fixes: 644b4646c7ac ("OpenSSH: Update to 10.1p1") Reviewed by: kib, emaste Differential Revision: https://reviews.freebsd.org/D57034 lib/libc/gen/nlist.3 | 8 +-- lib/libc/gen/nlist.c | 150 ++++++++++++++++++++++++++++----------------------- 2 files changed, 87 insertions(+), 71 deletions(-)
(In reply to commit-hook from comment #14) Hi, Thank you for the patch. Unfortunately, this patch didn't fix the problem. I performed a cleanworld build on commit 1d0410fb349fded5a79db3c6e6d993eb9efcc10c. ``` [pouria@cornelia] [/usr/src] [main|✔] % uname -ra FreeBSD cornelia.spmzt.net 16.0-CURRENT FreeBSD 16.0-CURRENT #0 main-n286020-1d0410fb349f: Thu May 21 10:28:30 +0330 2026 [pouria@cornelia] [/usr/src] [main|✔] % ssh-agent -d -a /tmp/agent.socket SSH_AUTH_SOCK=/tmp/agent.socket; export SSH_AUTH_SOCK; echo Agent pid 48952; debug1: new_socket: type = SOCKET debug2: fd 3 setting O_NONBLOCK debug1: new_socket: type = CONNECTION debug1: xcount 1 -> 2 debug3: fd 4 is O_NONBLOCK debug1: process_message: socket 1 (fd=4) type 20 debug2: process_add_smartcard_key: entering debug1: process_add_smartcard_key: add /usr/local/lib/libykcs11.so.2.7.2 debug3: pkcs11_start_helper: start helper for /usr/local/lib/libykcs11.so.2.7.2 debug3: pkcs11_start_helper: helper 0 for "/usr/local/lib/libykcs11.so.2.7.2" on fd 5 pid 34864 debug3: Fssh_pkcs11_add_provider: add /usr/local/lib/libykcs11.so.2.7.2 debug1: pkcs11_start_helper: starting /usr/libexec/ssh-pkcs11-helper -vvv debug3: Fssh_pkcs11_init: called, interactive = 0 debug1: process_add debug3: process_add: add /usr/local/lib/libykcs11.so.2.7.2 Fssh_lib_contains_symbol: library /usr/local/lib/libykcs11.so.2.7.2 does not contain symbol C_GetFunctionList provider /usr/local/lib/libykcs11.so.2.7.2 is not a PKCS11 library debug3: Fssh_pkcs11_add_provider: response 5 debug1: Fssh_pkcs11_add_provider: no keys; terminate helper debug3: helper_terminate: terminating helper for /usr/local/lib/libykcs11.so.2.7.2; remaining 0 keys debug1: read eof debug1: xcount 2 -> 1 debug1: new_socket: type = CONNECTION debug1: xcount 1 -> 2 debug3: fd 4 is O_NONBLOCK debug1: process_message: socket 1 (fd=4) type 20 debug2: process_add_smartcard_key: entering debug1: process_add_smartcard_key: add /usr/local/lib/opensc-pkcs11.so debug3: pkcs11_start_helper: start helper for /usr/local/lib/opensc-pkcs11.so debug3: pkcs11_start_helper: helper 0 for "/usr/local/lib/opensc-pkcs11.so" on fd 5 pid 69191 debug3: Fssh_pkcs11_add_provider: add /usr/local/lib/opensc-pkcs11.so debug1: pkcs11_start_helper: starting /usr/libexec/ssh-pkcs11-helper -vvv debug3: Fssh_pkcs11_init: called, interactive = 0 debug1: process_add debug3: process_add: add /usr/local/lib/opensc-pkcs11.so Fssh_lib_contains_symbol: library /usr/local/lib/opensc-pkcs11.so does not contain symbol C_GetFunctionList provider /usr/local/lib/opensc-pkcs11.so is not a PKCS11 library debug3: Fssh_pkcs11_add_provider: response 5 debug1: Fssh_pkcs11_add_provider: no keys; terminate helper debug3: helper_terminate: terminating helper for /usr/local/lib/opensc-pkcs11.so; remaining 0 keys debug1: read eof debug1: xcount 2 -> 1 debug1: new_socket: type = CONNECTION debug1: xcount 1 -> 2 debug3: fd 4 is O_NONBLOCK debug1: process_message: socket 1 (fd=4) type 20 debug2: process_add_smartcard_key: entering debug1: process_add_smartcard_key: add /usr/local/lib/libpcsclite.so.1 debug3: pkcs11_start_helper: start helper for /usr/local/lib/libpcsclite.so.1 debug3: pkcs11_start_helper: helper 0 for "/usr/local/lib/libpcsclite.so.1" on fd 5 pid 765 debug3: Fssh_pkcs11_add_provider: add /usr/local/lib/libpcsclite.so.1 debug1: pkcs11_start_helper: starting /usr/libexec/ssh-pkcs11-helper -vvv debug3: Fssh_pkcs11_init: called, interactive = 0 debug1: process_add debug3: process_add: add /usr/local/lib/libpcsclite.so.1 Fssh_lib_contains_symbol: library /usr/local/lib/libpcsclite.so.1 does not contain symbol C_GetFunctionList provider /usr/local/lib/libpcsclite.so.1 is not a PKCS11 library debug3: Fssh_pkcs11_add_provider: response 5 debug1: Fssh_pkcs11_add_provider: no keys; terminate helper debug3: helper_terminate: terminating helper for /usr/local/lib/libpcsclite.so.1; remaining 0 keys debug1: read eof debug1: xcount 2 -> 1 ``` FYI, I'm using ssh in our base system. ``` [pouria@cornelia] [/usr/src] [main|✔] % which ssh /usr/bin/ssh [pouria@cornelia] [/usr/src] [main|✔] % which ssh-agent /usr/bin/ssh-agent [pouria@cornelia] [/usr/src] [main|✔] % pkg info openssh-portable pkg: No package(s) matching openssh-portable ```
Yes, there's a missing --nent in my patch, sorry.
(In reply to Dag-Erling Smørgrav from comment #16) Thank you so much for your work. Do you want me to test your patch before commit?
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=e9cbbf04d6fe24b3a207cf085122def72145742e commit e9cbbf04d6fe24b3a207cf085122def72145742e Author: Dag-Erling Smørgrav <des@FreeBSD.org> AuthorDate: 2026-05-21 09:26:47 +0000 Commit: Dag-Erling Smørgrav <des@FreeBSD.org> CommitDate: 2026-05-21 09:37:33 +0000 nlist: Decrement nent on match PR: 295336 MFC after: 1 week Fixes: 4617a6cb82a6 ("nlist: Handle multiple symbol tables") lib/libc/gen/nlist.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
(In reply to commit-hook from comment #18) Fixed, Thank you.
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=5a0d8a7065a078475532e2fd2b8780942d69ea0a commit 5a0d8a7065a078475532e2fd2b8780942d69ea0a Author: Dag-Erling Smørgrav <des@FreeBSD.org> AuthorDate: 2026-05-19 06:52:53 +0000 Commit: Dag-Erling Smørgrav <des@FreeBSD.org> CommitDate: 2026-05-27 09:03:20 +0000 nlist: Handle multiple symbol tables * Instead of looking for and stopping at the first SHT_SYMTAB section, iterate over all SHT_DYNSYM and SHT_SYMTAB sections until we've either found all our symbols or run out. * Perform bounds checks on section and string table offsets and sizes before attempting to mmap() the string table. * Perform bounds checks on individual symbol table entries before attempting to access the corresponding strings. * Stop treating _Foo and Foo as the same symbol. This unbreaks OpenSSH which uses nlist(3) to verify PKCS#11 providers. PR: 295336 MFC after: 1 week Fixes: 77909f597881 ("Initial elf nlist support [...]") Fixes: 644b4646c7ac ("OpenSSH: Update to 10.1p1") Reviewed by: kib, emaste Differential Revision: https://reviews.freebsd.org/D57034 (cherry picked from commit 4617a6cb82a673b02257257c1f5f8a3c8d2bb943) nlist: Decrement nent on match PR: 295336 MFC after: 1 week Fixes: 4617a6cb82a6 ("nlist: Handle multiple symbol tables") (cherry picked from commit e9cbbf04d6fe24b3a207cf085122def72145742e) lib/libc/gen/nlist.3 | 8 +-- lib/libc/gen/nlist.c | 150 ++++++++++++++++++++++++++++----------------------- 2 files changed, 88 insertions(+), 70 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=5999b12bf908689da72c8b0044176c66d03a723e commit 5999b12bf908689da72c8b0044176c66d03a723e Author: Dag-Erling Smørgrav <des@FreeBSD.org> AuthorDate: 2026-05-19 06:52:53 +0000 Commit: Dag-Erling Smørgrav <des@FreeBSD.org> CommitDate: 2026-05-27 09:03:28 +0000 nlist: Handle multiple symbol tables * Instead of looking for and stopping at the first SHT_SYMTAB section, iterate over all SHT_DYNSYM and SHT_SYMTAB sections until we've either found all our symbols or run out. * Perform bounds checks on section and string table offsets and sizes before attempting to mmap() the string table. * Perform bounds checks on individual symbol table entries before attempting to access the corresponding strings. * Stop treating _Foo and Foo as the same symbol. This unbreaks OpenSSH which uses nlist(3) to verify PKCS#11 providers. PR: 295336 MFC after: 1 week Fixes: 77909f597881 ("Initial elf nlist support [...]") Fixes: 644b4646c7ac ("OpenSSH: Update to 10.1p1") Reviewed by: kib, emaste Differential Revision: https://reviews.freebsd.org/D57034 (cherry picked from commit 4617a6cb82a673b02257257c1f5f8a3c8d2bb943) nlist: Decrement nent on match PR: 295336 MFC after: 1 week Fixes: 4617a6cb82a6 ("nlist: Handle multiple symbol tables") (cherry picked from commit e9cbbf04d6fe24b3a207cf085122def72145742e) lib/libc/gen/nlist.3 | 8 +-- lib/libc/gen/nlist.c | 150 ++++++++++++++++++++++++++++----------------------- 2 files changed, 88 insertions(+), 70 deletions(-)