The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=486dfbb67e093a461a5ebd97f66be9b345f9de77
commit 486dfbb67e093a461a5ebd97f66be9b345f9de77 Author: John Baldwin <[email protected]> AuthorDate: 2026-07-31 17:52:42 +0000 Commit: John Baldwin <[email protected]> CommitDate: 2026-07-31 17:52:42 +0000 kld: Reject kernel modules with PT_LOAD segments where filesz > memsz All sorts of places in the ELF loading code assume that filesz <= memsz, so check that explicitly up front. Reported by: Jane Smith <[email protected]> (via D57785) Reviewed by: jrtc27, kib Differential Revision: https://reviews.freebsd.org/D58542 --- sys/kern/link_elf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c index 6ab5f4a39580..d7aeefa25433 100644 --- a/sys/kern/link_elf.c +++ b/sys/kern/link_elf.c @@ -1110,6 +1110,14 @@ link_elf_load_file(linker_class_t cls, const char* filename, error = ENOEXEC; goto out; } + + if (phdr->p_memsz < phdr->p_filesz) { + link_elf_error(filename, + "Invalid program header"); + error = ENOEXEC; + goto out; + } + /* * XXX: We just trust they come in right order ?? */
