# Re: \[PATCH\] module: reject out-of-range relocation target indices

- From: sashiko-bot@kernel.org
- Date: 2026-09-08 23:18:27 
- List: linux-modules
- Page: https://ratatoskr.run/linux-modules/2026/09/17534336
- Thread: https://ratatoskr.run/linux-modules/2026/09/17534299/t.md

```text
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A malformed ELF file with e_shnum == 0 can bypass the section header array bounds check and cause an out-of-bounds read when unconditionally accessing sechdrs[0].
--

commit eb153e5069bc4f227bac013d4c0cba2f178ed824
Author: Karl Mehltretter [ref]

    module: reject out-of-range relocation target indices
    
    apply_relocations() skips relocation sections whose sh_info target index
    is outside the section table. ARM, ARM64, LoongArch, PA-RISC and RISC-V
    use sh_info earlier in module_frob_arch_sections(), before this check.

> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index d0e1e0bd2ad06..30c7a05488bc3 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c

[ ... ]

> @@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info *info)
>  	/* Validate contents are inbounds */
>  	for (i = 1; i < info->hdr->e_shnum; i++) {
>  		shdr = &sechdrs[i];

[Severity: High]
This is a pre-existing issue, but can a malformed ELF file with e_shnum == 0
bypass the section header array bounds check and cause an out-of-bounds read?

Earlier in elf_validity_cache_sechdrs() in kernel/module/main.c, the bounds
check multiplies by e_shnum:

	if (info->hdr->e_shoff >= info->len
	    || (info->hdr->e_shnum * sizeof(Elf_Shdr) >
		info->len - info->hdr->e_shoff)) {

If e_shnum is 0, this evaluates to 0 and passes, failing to ensure space for
even the mandatory sechdrs[0].

Then the code computes sechdrs and unconditionally accesses sechdrs[0]:

	sechdrs = (void *)info->hdr + info->hdr->e_shoff;

	if (sechdrs[0].sh_type != SHT_NULL
	    || sechdrs[0].sh_size != 0
	    || sechdrs[0].sh_addr != 0) {

If e_shoff is arbitrarily set near the end of info->len, does this
unconditional access to sechdrs[0] cross the vmalloc allocation boundary?

This could hit an unmapped guard page and cause a fatal page fault and
kernel Oops.

Could this sequence be triggered by a privileged user with CAP_SYS_MODULE
calling init_module() with an ELF file where info->len is exactly PAGE_SIZE,
e_shnum is 0, and e_shoff is PAGE_SIZE - 1?

> +		if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) &&
> +		    shdr->sh_info >= info->hdr->e_shnum) {
> +			pr_err("Invalid ELF relocation section target index %u\n",
> +			       shdr->sh_info);
> +			return -ENOEXEC;
> +		}
>  		switch (shdr->sh_type) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908230815.78409-1-kmehltretter@gmail.com?part=1
```