From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061162; b=KMBs2bUZ8UMRwJlCayC17Q86Hn8x3O0PN8+gE41jnjqxr+trAh7xYOG4krH0ehlYFNgX LAi6HtIJktu4BLzIOEDE5gEx/RyibBdhb7xVRu1pOIiH+srexdtRVUP+cR7FqI4Sr9H8i Mz9dFA+o3AHrGswIIY1YG05uPJAVL6r7YaGT42GgVo3tqziqg82nhCRG4FRPqsdBEzfvh tNPFX1EuKjXEAGnfHyzV6AwwTd5WFi57HXHHv5FUARKj8z6vc9tA5DkQ9+hXTawoMvWjO 5doQp6ufuxb2K70yFexav9GQg8Q2KgFG7cS2g9JoenCr1aX+LT1DkAljHRV5OsgfpKA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061162; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=0NK4JLfeMF3r9AAbL48Ep00L1DfwBZtV+m2sxIvYHv0=; b=r4XUmwtXqL6P1cOI3NfOwo30S7u1msBCUX8VOoZlw95T6V+fKp2xbs+ekOfRr23BGgYT 7oWuWe2Se0XD9kEIYKdSc7izC6jbymMKQeDnPm997+ZCZp7W1brTcbFDHGP8BF/hNofrI IYwvRuz/N0k7sa7Oe4g3NKnWADeQ+xSC0NrRyNg0gJEeQEg7hAVgu+KM8/FvcXEDQi8JT jw+0MvJ+EPKoZ3W0hmMabN7buzJoYRtloNw2H+ybsEZWARllUahdIcj2s2mB+hkUvCPgU ZTOHu88Oz5Cjft+EoeJWtlfXSqTp3hRpIJp/2WupJuUpRZESIk7FBAXKO+wqHHEKWUA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=I5xTZsYy; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 19BE5606D805; Sat, 7 Nov 2026 14:19:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=I5xTZsYy Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB3F71F0089F; Sat, 7 Nov 2026 14:19:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061162; bh=0NK4JLfeMF3r9AAbL48Ep00L1DfwBZtV+m2sxIvYHv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=I5xTZsYy6y47CyG3Wd4mGLnbBPjtQSWHoZrW2qtDveYeKZ+/16bpTBmb91Ujz5RnO uxq56ep981Z+t22BgZwI6o9YVxqG52dKnL/T5gED34sKJTX9wU7gr/20b8WYuw+IvV +xbEhmwhTucmbq6rVZWKeuJnD9nnJ9PCwKV6E/T0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Matthew Maurer , Sami Tolvanen , Luis Chamberlain , Sasha Levin Subject: [PATCH 6.12 0468/1536] module: Factor out elf_validity_cache_secstrings Date: Sat, 7 Nov 2026 08:41:24 -0500 Message-ID: <20261107135010.659741602@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Matthew Maurer [ Upstream commit 3c5700aeabd87e81d9153a7666b28d0e405c6c88 ] Factor out the validation of section names. There are two behavioral changes: 1. Previously, we did not validate non-SHF_ALLOC sections. This may have once been safe, as find_sec skips non-SHF_ALLOC sections, but find_any_sec, which will be used to load BTF if that is enabled, ignores the SHF_ALLOC flag. Since there's no need to support invalid section names, validate all of them, not just SHF_ALLOC sections. 2. Section names were validated *after* accessing them for the purposes of detecting ".modinfo" and ".gnu.linkonce.this_module". They are now checked prior to the access, which could avoid bad accesses with malformed modules. Signed-off-by: Matthew Maurer Reviewed-by: Sami Tolvanen Signed-off-by: Luis Chamberlain Stable-dep-of: 9a5ff4568932 ("module: validate string table section types") Signed-off-by: Sasha Levin --- kernel/module/main.c | 106 ++++++++++++++++++++++++++++--------------- 1 file changed, 69 insertions(+), 37 deletions(-) diff --git a/kernel/module/main.c b/kernel/module/main.c index 4a458c36405ba..6314938422bc5 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -1798,6 +1798,71 @@ static int elf_validity_cache_sechdrs(struct load_info *info) return 0; } +/** + * elf_validity_cache_secstrings() - Caches section names if valid + * @info: Load info to cache section names from. Must have valid sechdrs. + * + * Specifically checks: + * + * * Section name table index is inbounds of section headers + * * Section name table is not empty + * * Section name table is NUL terminated + * * All section name offsets are inbounds of the section + * + * Then updates @info with a &load_info->secstrings pointer if valid. + * + * Return: %0 if valid, negative error code if validation failed. + */ +static int elf_validity_cache_secstrings(struct load_info *info) +{ + Elf_Shdr *strhdr, *shdr; + char *secstrings; + int i; + + /* + * Verify if the section name table index is valid. + */ + if (info->hdr->e_shstrndx == SHN_UNDEF + || info->hdr->e_shstrndx >= info->hdr->e_shnum) { + pr_err("Invalid ELF section name index: %d || e_shstrndx (%d) >= e_shnum (%d)\n", + info->hdr->e_shstrndx, info->hdr->e_shstrndx, + info->hdr->e_shnum); + return -ENOEXEC; + } + + strhdr = &info->sechdrs[info->hdr->e_shstrndx]; + + /* + * The section name table must be NUL-terminated, as required + * by the spec. This makes strcmp and pr_* calls that access + * strings in the section safe. + */ + secstrings = (void *)info->hdr + strhdr->sh_offset; + if (strhdr->sh_size == 0) { + pr_err("empty section name table\n"); + return -ENOEXEC; + } + if (secstrings[strhdr->sh_size - 1] != '\0') { + pr_err("ELF Spec violation: section name table isn't null terminated\n"); + return -ENOEXEC; + } + + for (i = 0; i < info->hdr->e_shnum; i++) { + shdr = &info->sechdrs[i]; + /* SHT_NULL means sh_name has an undefined value */ + if (shdr->sh_type == SHT_NULL) + continue; + if (shdr->sh_name >= strhdr->sh_size) { + pr_err("Invalid ELF section name in module (section %u type %u)\n", + i, shdr->sh_type); + return -ENOEXEC; + } + } + + info->secstrings = secstrings; + return 0; +} + /* * Check userspace passed ELF module against our expectations, and cache * useful variables for further processing as we go. @@ -1821,7 +1886,7 @@ static int elf_validity_cache_sechdrs(struct load_info *info) static int elf_validity_cache_copy(struct load_info *info, int flags) { unsigned int i; - Elf_Shdr *shdr, *strhdr; + Elf_Shdr *shdr; int err; unsigned int num_mod_secs = 0, mod_idx; unsigned int num_info_secs = 0, info_idx; @@ -1830,34 +1895,9 @@ static int elf_validity_cache_copy(struct load_info *info, int flags) err = elf_validity_cache_sechdrs(info); if (err < 0) return err; - - /* - * Verify if the section name table index is valid. - */ - if (info->hdr->e_shstrndx == SHN_UNDEF - || info->hdr->e_shstrndx >= info->hdr->e_shnum) { - pr_err("Invalid ELF section name index: %d || e_shstrndx (%d) >= e_shnum (%d)\n", - info->hdr->e_shstrndx, info->hdr->e_shstrndx, - info->hdr->e_shnum); - goto no_exec; - } - - strhdr = &info->sechdrs[info->hdr->e_shstrndx]; - - /* - * The section name table must be NUL-terminated, as required - * by the spec. This makes strcmp and pr_* calls that access - * strings in the section safe. - */ - info->secstrings = (void *)info->hdr + strhdr->sh_offset; - if (strhdr->sh_size == 0) { - pr_err("empty section name table\n"); - goto no_exec; - } - if (info->secstrings[strhdr->sh_size - 1] != '\0') { - pr_err("ELF Spec violation: section name table isn't null terminated\n"); - goto no_exec; - } + err = elf_validity_cache_secstrings(info); + if (err < 0) + return err; for (i = 1; i < info->hdr->e_shnum; i++) { shdr = &info->sechdrs[i]; @@ -1886,14 +1926,6 @@ static int elf_validity_cache_copy(struct load_info *info, int flags) num_info_secs++; info_idx = i; } - - if (shdr->sh_flags & SHF_ALLOC) { - if (shdr->sh_name >= strhdr->sh_size) { - pr_err("Invalid ELF section name in module (section %u type %u)\n", - i, shdr->sh_type); - return -ENOEXEC; - } - } break; } } -- 2.53.0