get_modinfo() and module_next_tag_pair() parse .modinfo as a sequence of NUL-terminated tag=value strings. elf_validity_cache_index_info() caches the .modinfo section index and immediately calls get_modinfo() to find the module name for early error reporting, but it does not verify that the section is non-empty or NUL-terminated first.
A malformed module can therefore make the loader read past the end of .modinfo while searching for a tag. Reject empty .modinfo sections and sections that are not NUL-terminated before parsing them. Signed-off-by: Laxman Acharya Padhya <[email protected]> --- kernel/module/main.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kernel/module/main.c b/kernel/module/main.c index 46dd8d25a..7450319f9 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -2083,6 +2083,8 @@ static int elf_validity_cache_secstrings(struct load_info *info) static int elf_validity_cache_index_info(struct load_info *info) { int info_idx; + Elf_Shdr *info_shdr; + char *modinfo; info_idx = find_any_unique_sec(info, ".modinfo"); @@ -2096,6 +2098,18 @@ static int elf_validity_cache_index_info(struct load_info *info) } info->index.info = info_idx; + info_shdr = &info->sechdrs[info_idx]; + modinfo = (char *)info->hdr + info_shdr->sh_offset; + + if (info_shdr->sh_size == 0) { + pr_err("empty .modinfo section\n"); + return -ENOEXEC; + } + if (modinfo[info_shdr->sh_size - 1] != '\0') { + pr_err(".modinfo section isn't NUL terminated\n"); + return -ENOEXEC; + } + /* Try to find a name early so we can log errors with a module name */ info->name = get_modinfo(info, "name"); -- 2.51.2
