From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-183.mta1.migadu.com (out-183.mta1.migadu.com [95.215.58.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F5222DCF70 for ; Tue, 30 Dec 2025 00:59:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.183 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767056365; cv=none; b=f3H4rLjmxz0cenAqJlm7ot2BrbmNVeykUHE8ingvg8jHcrWrHcz7kvfkkCJTjcZu9bR89fEt8AxErHxkukHItgInovNH/3k2r3gGKsyMMdnC7w17XGEZRkHm05K7ldIpIj7tXVNlihx6oEtmoHg1WW5jyUQFA0woiDS3MdRWnxU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767056365; c=relaxed/simple; bh=2lxDnwdsZekXe4NfDsKQJITWCMDUWP6xiRX5VchwVV4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=i/VNADts5yLU90PsjaMUHC76ju/yZY8QZQDqaVXhyhrAVL2/sh6I0NB2B76yRFF87EqSRfmBKUIaz3jvgBzOMA03fvr0Gxt/8SPJmlV/8d42Hp+i9/Aw/JAMTjAVuYRwHNutZxSM6hD6MhZCo6+6zL0xR+/9UTNqLi22wlnWpCQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=oLZ7OzKO; arc=none smtp.client-ip=95.215.58.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="oLZ7OzKO" Message-ID: <26800836-3864-47ec-910b-aed571758f04@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1767056351; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TSyzvjl2It73lqYA6EDJUDBcvQxjHw4X7Zb7XrvQVUQ=; b=oLZ7OzKOpf4AbXx1p7wAm4IkLiVOcM7MnlHBnQYpYeKv2eymkHXiCpvQz03QcYr9tU4Bcc WO/jFUHfHLy+ol+q9jTWIiewXfC4ZhoMW2JWLqXm3jpqTCQ0vVgUq9r9RnZRw1hiOGyWHH FgosFZ8sEO9qw+v4wRKSoxAGCYXUflA= Date: Mon, 29 Dec 2025 16:59:03 -0800 Precedence: bulk X-Mailing-List: linux-modules@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Subject: Re: [RFC PATCH v1] module: Fix kernel panic when a symbol st_shndx is out of bounds To: Alexei Starovoitov Cc: Nathan Chancellor , Yonghong Song , Luis Chamberlain , Petr Pavlu , Daniel Gomez , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , LKML , linux-modules@vger.kernel.org, bpf , Linux Kbuild mailing list , clang-built-linux References: <20251224005752.201911-1-ihor.solodrai@linux.dev> <9edd1395-8651-446b-b056-9428076cd830@linux.dev> <20251229212938.GA2701672@ax162> <6b87701b-98fb-4089-a201-a7b402e338f9@linux.dev> Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Ihor Solodrai In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT On 12/29/25 4:50 PM, Alexei Starovoitov wrote: > On Mon, Dec 29, 2025 at 4:39 PM Ihor Solodrai wrote: >> >> [...] >> >> >> From 7c3b9cce97cc76d0365d8948b1ca36c61faddde3 Mon Sep 17 00:00:00 2001 >> From: Ihor Solodrai >> Date: Mon, 29 Dec 2025 15:49:51 -0800 >> Subject: [PATCH] BTF_OBJCOPY >> >> --- >> Makefile | 6 +++++- >> lib/Kconfig.debug | 1 + >> scripts/gen-btf.sh | 10 +++++----- >> scripts/link-vmlinux.sh | 2 +- >> tools/testing/selftests/bpf/Makefile | 4 ++-- >> 5 files changed, 14 insertions(+), 9 deletions(-) > > All the makefile hackery looks like overkill and wrong direction. > > What's wrong with kernel/module/main.c change? > > Module loading already does a bunch of sanity checks for ELF > in elf_validity_cache_copy(). > > + if (sym[i].st_shndx >= info->hdr->e_shnum) > is just one more. > > Maybe it can be moved to elf_validity*() somewhere, > but that's a minor detail. > > iiuc llvm-objcopy affects only bpf testmod, so not a general > issue that needs top level makefile changes. AFAIU, the problem is that the llvm-objcopy bug is essentially use-after-free [1], that may (or may not) corrupt st_shndx value of some symbols when executing --update-section. And so we can't trust this command anywhere in the kernel build, even though it only manifested itself in a BPF test module. With the gen-btf.sh changes ${OBJCOPY} --update-section is called for all binaries with .BTF_ids: vmlinux and all modules. The fix in module.c is an independent kernel bug, that is hopefully fixed with the st_shndx check. [1] https://github.com/llvm/llvm-project/issues/168060#issuecomment-3533552952