On 9 September 2026 00:08:15 BST, Karl Mehltretter <[email protected]>
wrote:
>apply_relocations() skips relocation sections whose sh_info target index
>is outside the section table. ARM, ARM64, LoongArch, PA-RISC and RISC-V
>use sh_info earlier in module_frob_arch_sections(), before this check.
>
>ARM, ARM64, LoongArch and RISC-V use the unchecked index to read
>sh_flags outside the section header table. PA-RISC uses it to index an
>e_shnum-sized heap array for a read and an update. QEMU reproduced
>page-fault Oopses on ARM, ARM64, LoongArch and RISC-V, and a Data TLB
>miss on the PA-RISC array read.
>
>Validate sh_info for SHT_REL and SHT_RELA sections in
>elf_validity_cache_sechdrs(). Reject the module with ENOEXEC before
>architecture code can use the index.
>
>Fixes: c298be74492b ("parisc: fix module loading failure of large kernel
>modules")
>Fixes: 7d485f647c1f ("ARM: 8220/1: allow modules outside of bl range")
>Fixes: fd045f6cd98e ("arm64: add support for module PLTs")
>Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module")
>Fixes: fcdfe9d22bed ("LoongArch: Add ELF and module support")
>Cc: [email protected]
>Assisted-by: LLM
>Signed-off-by: Karl Mehltretter <[email protected]>
I don't think so, sorry, see below.
>---
>
>A custom harness for upstream Frama-C 33.0 (Arsenic) Eva found the
>ARM32 instance in a source-identical ARM module_frob_arch_sections()
>slice. Eva reported the out-of-range section-table pointer and sh_flags
>access.
>
>The analysis and ARM32 A/B test ran at Linux b9b3e33b70b7 ("Merge tag
>'trace-v7.2-rc6' of
>git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace"). The
>PA-RISC, ARM64, RISC-V, LoongArch and x86_64 A/B tests ran at the
>declared base commit, 28924df2a08f. arch/arm/kernel/module-plts.c and
>the touched loop in kernel/module/main.c are identical between the two
>commits.
>
>Each A/B test changed only a relocation section's sh_info to
>0x10000000. The same configurations and modules were used before and
>after the change. All controls loaded before and after the change. The
>fixed kernels rejected the malformed modules with ENOEXEC.
>
>Original-kernel results with QEMU 10.2.1 TCG:
>
>- ARM32, virt/Cortex-A15, GCC 15.2.0, multi_v7_defconfig plus
> VMSPLIT_2G: page fault at module_frob_arch_sections()+0x160.
>- ARM64, virt/Cortex-A57, GCC 15.2.0, defconfig: page fault at
> module_frob_arch_sections()+0x110.
>- PA-RISC, B160L, hppa-linux-gcc 8.1.0, binutils 2.30,
> generic-32bit_defconfig: Data TLB miss at
> module_frob_arch_sections()+0x11c on the stub_entries read for a
> counted R_PARISC_PCREL17F relocation.
>- RISC-V, virt, GCC 15.2.0, defconfig plus RELOCATABLE with
> MODULE_SECTIONS enabled: page fault at
> module_frob_arch_sections()+0xe4.
>- LoongArch, virt/LA464, LLVM 21.1.8, loongson64_defconfig: page fault
> at module_frob_arch_sections()+0x1b8.
>
>On x86_64, which has no vulnerable early sh_info access, the original
>kernel loaded both modules. The fixed kernel loaded the control and
>rejected the malformed module with ENOEXEC. The test used pc/qemu64,
>x86_64_defconfig and GCC 15.2.0.
>---
> kernel/module/main.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
>diff --git a/kernel/module/main.c b/kernel/module/main.c
>index d0e1e0bd2ad0..30c7a05488bc 100644
>--- a/kernel/module/main.c
>+++ b/kernel/module/main.c
>@@ -1933,6 +1933,7 @@ static int elf_validity_ehdr(const struct load_info
>*info)
> * * Section array fits in the user provided data
> * * Section index 0 is NULL
> * * Section contents are inbounds
>+ * * Relocation section target indices are inbounds
> *
> * Then updates @info with a &load_info->sechdrs pointer if valid.
> *
>@@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info
>*info)
> /* Validate contents are inbounds */
> for (i = 1; i < info->hdr->e_shnum; i++) {
> shdr = &sechdrs[i];
>+ if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) &&
>+ shdr->sh_info >= info->hdr->e_shnum) {
>+ pr_err("Invalid ELF relocation section target index
>%u\n",
>+ shdr->sh_info);
>+ return -ENOEXEC;
>+ }
> switch (shdr->sh_type) {
> case SHT_NULL:
> case SHT_NOBITS:
If the module passes the signature check and the blacklist check, the
kernel would assume that the module is fine and ^W^W^W^W won't blow the
whole
world up^W^W^W^W^W
Since module_frob_arch_sections() loads AFTER said checks pass, adding
checks is just useless bloat imho.
NAK, sorry
>
>base-commit: 28924df2a08f440c73991b83028032c901de2ae4
>
--- Thanks!
https://lore.kernel.org/all/[email protected]/
