[PATCH] module: reject malformed .modinfo sections

get_modinfo() and module_next_tag_pair() parse .modinfo as a sequence of NUL-terminated tag=value strings. elf_validity_cache_index_info() caches the .modinfo section index and immediately calls get_modinfo() to find the module name for early error reporting, but it does not verify that the section is non-empty or NUL-terminated first.

A malformed module can therefore make the loader read past the end of .modinfo while searching for a tag.

Reject empty .modinfo sections and sections that are not NUL-terminated before parsing them.

Signed-off-by: Laxman Acharya Padhya <[email protected]>
---
 kernel/module/main.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/kernel/module/main.c b/kernel/module/main.c
index 46dd8d25a..7450319f9 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -2083,6 +2083,8 @@ static int elf_validity_cache_secstrings(struct load_info *info)
 static int elf_validity_cache_index_info(struct load_info *info)
 {
 	int info_idx;
+	Elf_Shdr *info_shdr;
+	char *modinfo;
 
 	info_idx = find_any_unique_sec(info, ".modinfo");
 
@@ -2096,6 +2098,18 @@ static int elf_validity_cache_index_info(struct load_info *info)
 	}
 
 	info->index.info = info_idx;
+	info_shdr = &info->sechdrs[info_idx];
+	modinfo = (char *)info->hdr + info_shdr->sh_offset;
+
+	if (info_shdr->sh_size == 0) {
+		pr_err("empty .modinfo section\n");
+		return -ENOEXEC;
+	}
+	if (modinfo[info_shdr->sh_size - 1] != '\0') {
+		pr_err(".modinfo section isn't NUL terminated\n");
+		return -ENOEXEC;
+	}
+
 	/* Try to find a name early so we can log errors with a module name */
 	info->name = get_modinfo(info, "name");
 
-- 
2.51.2