On Wed, Jul 08, 2026 at 11:21:07AM +1000, Thiébaud Weksteen wrote: > In elf_validity_cache_sechdrs, section sizes and offsets are validated, > unless the section type is SHT_NULL or SHT_NOBITS. > > Later, elf_validity_cache_secstrings and elf_validity_cache_index_str > access the section name table (.shstrtab) and symbol string table > (.strtab) headers without first ensuring that their types are > SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has > not been validated and may reference out-of-bounds memory when > dereferenced in elf_validity_cache_secstrings or > elf_validity_cache_strtab. > > Validate that both string section headers are of type SHT_STRTAB before > caching them. > > Signed-off-by: Thiébaud Weksteen <[email protected]> > --- > kernel/module/main.c | 14 +++++++++++++- > 1 file changed, 13 insertions(+), 1 deletion(-) > > diff --git a/kernel/module/main.c b/kernel/module/main.c > index 46dd8d25a605..7cbc8f0e28c6 100644 > --- a/kernel/module/main.c > +++ b/kernel/module/main.c > @@ -2011,6 +2011,7 @@ static int elf_validity_cache_sechdrs(struct load_info > *info) > * Specifically checks: > * > * * Section name table index is inbounds of section headers > + * * Section name table type is SHT_STRTAB > * * Section name table is not empty > * * Section name table is NUL terminated > * * All section name offsets are inbounds of the section > @@ -2038,6 +2039,11 @@ static int elf_validity_cache_secstrings(struct > load_info *info) > > strhdr = &info->sechdrs[info->hdr->e_shstrndx]; > > + if (strhdr->sh_type != SHT_STRTAB) { > + pr_err("Invalid ELF section name table type: %u\n", > strhdr->sh_type); > + return -ENOEXEC; > + } > + > /* > * The section name table must be NUL-terminated, as required > * by the spec. This makes strcmp and pr_* calls that access > @@ -2204,7 +2210,7 @@ static int elf_validity_cache_index_sym(struct > load_info *info) > * Must have &load_info->index.sym populated. > * > * Looks at the symbol table's associated string table, makes sure it is > - * in-bounds, and caches it. > + * in-bounds and of type SHT_STRTAB, and caches it. > * > * Return: %0 if valid, %-ENOEXEC on failure. > */ > @@ -2218,6 +2224,12 @@ static int elf_validity_cache_index_str(struct > load_info *info) > return -ENOEXEC; > } > > + if (info->sechdrs[str_idx].sh_type != SHT_STRTAB) { > + pr_err("Invalid ELF symbol string table type: %u\n", > + info->sechdrs[str_idx].sh_type); > + return -ENOEXEC; > + } > + > info->index.str = str_idx; > return 0; > } > -- > 2.55.0.795.g602f6c329a-goog >
Reviewed-by: Aaron Tomlin <[email protected]> -- Aaron Tomlin
