[PATCH v2 0/2] module: close two ELF section-validation gaps

[Fang Xieyan <fangxy@xiaopeng.com>]

Both patches come from the same review of the module ELF validator, and
both fix an out-of-bounds read of a section field that the validator
leaves unchecked on purpose.

elf_validity_check_sectionheaders() exempts SHT_NULL and SHT_NOBITS
sections from its bounds checks, on the assumption that a section with
no contents has nothing to dereference. The loaders that run after it do
not share that assumption: they read sh_name and sh_offset for every
section, so an exempted section carries an unvalidated field into a
string lookup or a pointer computation. Commit 9a5ff4568932 ("module:
validate string table section types") closed two such gaps for
.shstrtab and .strtab; these two patches close the ones that remain.

Patch 1 gives the undefined sh_name of a SHT_NULL section a safe value,
so the section walkers that follow read the empty string instead of
running past .shstrtab.

Patch 2 requires the __version_ext_names section to be SHT_PROGBITS
before elf_validity_cache_index_versions() dereferences its sh_offset,
so a SHT_NOBITS section of that name - which the validator exempts and
which holds no file data - cannot drive the extended version name walk
outside the module image or make it read unrelated bytes as a name.

Each patch stands alone and can be applied or backported separately;
they are grouped only because they share a root cause. Both were
reproduced on 704340f1cd0d with KASAN, and each is fixed by its own
change.

Changes in v2. v1 was posted here:
https://lore.kernel.org/all/20260916174753.14870-1-fangxy@xiaopeng.com/

 - Patch 2: require __version_ext_names to be SHT_PROGBITS before its
   sh_offset is dereferenced, instead of bounding the offset. Review
   pointed out the offset bound is narrower than the bug: an in-bounds
   SHT_NOBITS section passes it and the walk then reads unrelated file
   bytes as a version name. The type check rejects both the
   out-of-bounds and the in-bounds variants; the reproducer now covers
   both. Details in the patch's tear-line notes.
 - Patch 1: unchanged since v1.

Fang Xieyan (2):
  module: Sanitize the undefined sh_name of SHT_NULL sections
  module: Validate the __version_ext_names section type

 kernel/module/main.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

-- 
2.50.1 (Apple Git-155)