Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] A malformed ELF file with e_shnum == 0 can bypass the section header array bounds check and cause an out-of-bounds read when unconditionally accessing sechdrs[0]. -- commit eb153e5069bc4f227bac013d4c0cba2f178ed824 Author: Karl Mehltretter <[email protected]> module: reject out-of-range relocation target indices apply_relocations() skips relocation sections whose sh_info target index is outside the section table. ARM, ARM64, LoongArch, PA-RISC and RISC-V use sh_info earlier in module_frob_arch_sections(), before this check. > diff --git a/kernel/module/main.c b/kernel/module/main.c > index d0e1e0bd2ad06..30c7a05488bc3 100644 > --- a/kernel/module/main.c > +++ b/kernel/module/main.c [ ... ] > @@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info > *info) > /* Validate contents are inbounds */ > for (i = 1; i < info->hdr->e_shnum; i++) { > shdr = &sechdrs[i]; [Severity: High] This is a pre-existing issue, but can a malformed ELF file with e_shnum == 0 bypass the section header array bounds check and cause an out-of-bounds read? Earlier in elf_validity_cache_sechdrs() in kernel/module/main.c, the bounds check multiplies by e_shnum: if (info->hdr->e_shoff >= info->len || (info->hdr->e_shnum * sizeof(Elf_Shdr) > info->len - info->hdr->e_shoff)) { If e_shnum is 0, this evaluates to 0 and passes, failing to ensure space for even the mandatory sechdrs[0]. Then the code computes sechdrs and unconditionally accesses sechdrs[0]: sechdrs = (void *)info->hdr + info->hdr->e_shoff; if (sechdrs[0].sh_type != SHT_NULL || sechdrs[0].sh_size != 0 || sechdrs[0].sh_addr != 0) { If e_shoff is arbitrarily set near the end of info->len, does this unconditional access to sechdrs[0] cross the vmalloc allocation boundary? This could hit an unmapped guard page and cause a fatal page fault and kernel Oops. Could this sequence be triggered by a privileged user with CAP_SYS_MODULE calling init_module() with an ELF file where info->len is exactly PAGE_SIZE, e_shnum is 0, and e_shoff is PAGE_SIZE - 1? > + if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) && > + shdr->sh_info >= info->hdr->e_shnum) { > + pr_err("Invalid ELF relocation section target index > %u\n", > + shdr->sh_info); > + return -ENOEXEC; > + } > switch (shdr->sh_type) { -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
