Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] A malformed ELF file with e_shnum == 0 can bypass the section header array bounds check and cause an out-of-bounds read when unconditionally accessing sechdrs[0].
--
commit eb153e5069bc4f227bac013d4c0cba2f178ed824
Author: Karl Mehltretter [off-list ref]
module: reject out-of-range relocation target indices
apply_relocations() skips relocation sections whose sh_info target index
is outside the section table. ARM, ARM64, LoongArch, PA-RISC and RISC-V
use sh_info earlier in module_frob_arch_sections(), before this check.
quoted hunk ↗ jump to hunk
diff --git a/kernel/module/main.c b/kernel/module/main.c
index d0e1e0bd2ad06..30c7a05488bc3 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info *info)
/* Validate contents are inbounds */
for (i = 1; i < info->hdr->e_shnum; i++) {
shdr = &sechdrs[i];
[Severity: High]
This is a pre-existing issue, but can a malformed ELF file with e_shnum == 0
bypass the section header array bounds check and cause an out-of-bounds read?
Earlier in elf_validity_cache_sechdrs() in kernel/module/main.c, the bounds
check multiplies by e_shnum:
if (info->hdr->e_shoff >= info->len
|| (info->hdr->e_shnum * sizeof(Elf_Shdr) >
info->len - info->hdr->e_shoff)) {
If e_shnum is 0, this evaluates to 0 and passes, failing to ensure space for
even the mandatory sechdrs[0].
Then the code computes sechdrs and unconditionally accesses sechdrs[0]:
sechdrs = (void *)info->hdr + info->hdr->e_shoff;
if (sechdrs[0].sh_type != SHT_NULL
|| sechdrs[0].sh_size != 0
|| sechdrs[0].sh_addr != 0) {
If e_shoff is arbitrarily set near the end of info->len, does this
unconditional access to sechdrs[0] cross the vmalloc allocation boundary?
This could hit an unmapped guard page and cause a fatal page fault and
kernel Oops.
Could this sequence be triggered by a privileged user with CAP_SYS_MODULE
calling init_module() with an ELF file where info->len is exactly PAGE_SIZE,
e_shnum is 0, and e_shoff is PAGE_SIZE - 1?
quoted hunk ↗ jump to hunk
+ if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) &&
+ shdr->sh_info >= info->hdr->e_shnum) {
+ pr_err("Invalid ELF relocation section target index %u\n",
+ shdr->sh_info);
+ return -ENOEXEC;
+ }
switch (shdr->sh_type) {
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908230815.78409-1-kmehltretter@gmail.com?part=1