Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:

Pre-existing issues:
- [High] A malformed ELF file with e_shnum == 0 can bypass the section header 
array bounds check and cause an out-of-bounds read when unconditionally 
accessing sechdrs[0].
--

commit eb153e5069bc4f227bac013d4c0cba2f178ed824
Author: Karl Mehltretter <[email protected]>

    module: reject out-of-range relocation target indices
    
    apply_relocations() skips relocation sections whose sh_info target index
    is outside the section table. ARM, ARM64, LoongArch, PA-RISC and RISC-V
    use sh_info earlier in module_frob_arch_sections(), before this check.

> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index d0e1e0bd2ad06..30c7a05488bc3 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c

[ ... ]

> @@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info 
> *info)
>       /* Validate contents are inbounds */
>       for (i = 1; i < info->hdr->e_shnum; i++) {
>               shdr = &sechdrs[i];

[Severity: High]
This is a pre-existing issue, but can a malformed ELF file with e_shnum == 0
bypass the section header array bounds check and cause an out-of-bounds read?

Earlier in elf_validity_cache_sechdrs() in kernel/module/main.c, the bounds
check multiplies by e_shnum:

        if (info->hdr->e_shoff >= info->len
            || (info->hdr->e_shnum * sizeof(Elf_Shdr) >
                info->len - info->hdr->e_shoff)) {

If e_shnum is 0, this evaluates to 0 and passes, failing to ensure space for
even the mandatory sechdrs[0].

Then the code computes sechdrs and unconditionally accesses sechdrs[0]:

        sechdrs = (void *)info->hdr + info->hdr->e_shoff;

        if (sechdrs[0].sh_type != SHT_NULL
            || sechdrs[0].sh_size != 0
            || sechdrs[0].sh_addr != 0) {

If e_shoff is arbitrarily set near the end of info->len, does this
unconditional access to sechdrs[0] cross the vmalloc allocation boundary?

This could hit an unmapped guard page and cause a fatal page fault and
kernel Oops.

Could this sequence be triggered by a privileged user with CAP_SYS_MODULE
calling init_module() with an ELF file where info->len is exactly PAGE_SIZE,
e_shnum is 0, and e_shoff is PAGE_SIZE - 1?

> +             if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) &&
> +                 shdr->sh_info >= info->hdr->e_shnum) {
> +                     pr_err("Invalid ELF relocation section target index 
> %u\n",
> +                            shdr->sh_info);
> +                     return -ENOEXEC;
> +             }
>               switch (shdr->sh_type) {

-- 
Sashiko AI review ยท 
https://sashiko.dev/#/patchset/[email protected]?part=1

Reply via email to