git: 486dfbb67e09 - main - kld: Reject kernel modules with PT_LOAD segments where filesz > memsz
John Baldwin <[email protected]> Fri, 31 Jul 2026 17:57:39 +0000
| Newsgroups | gmane.os.freebsd.devel.cvs.src |
|---|---|
| Message-ID | <6a6ce213.3e9e0.7622834f__32821.6606679902$1785520719$gmane$org@gitrepo.freebsd.org> |
The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=486dfbb67e093a461a5ebd97f66be9b345f9de77 commit 486dfbb67e093a461a5ebd97f66be9b345f9de77 Author: John Baldwin <[email protected]> AuthorDate: 2026-07-31 17:52:42 +0000 Commit: John Baldwin <[email protected]> CommitDate: 2026-07-31 17:52:42 +0000 kld: Reject kernel modules with PT_LOAD segments where filesz > memsz All sorts of places in the ELF loading code assume that filesz <= memsz, so check that explicitly up front. Reported by: Jane Smith <[email protected]> (via D57785) Reviewed by: jrtc27, kib Differential Revision: https://reviews.freebsd.org/D58542 --- sys/kern/link_elf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c index 6ab5f4a39580..d7aeefa25433 100644 --- a/sys/kern/link_elf.c +++ b/sys/kern/link_elf.c @@ -1110,6 +1110,14 @@ link_elf_load_file(linker_class_t cls, const char* filename, error = ENOEXEC; goto out; } + + if (phdr->p_memsz < phdr->p_filesz) { + link_elf_error(filename, + "Invalid program header"); + error = ENOEXEC; + goto out; + } + /* * XXX: We just trust they come in right order ?? */