Date: Fri, 31 Jul 2026 17:57:39 +0000 From: John Baldwin <jhb@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: 486dfbb67e09 - main - kld: Reject kernel modules with PT_LOAD segments where filesz > memsz Message-ID: <6a6ce213.3e9e0.7622834f@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=486dfbb67e093a461a5ebd97f66be9b345f9de77 commit 486dfbb67e093a461a5ebd97f66be9b345f9de77 Author: John Baldwin <jhb@FreeBSD.org> AuthorDate: 2026-07-31 17:52:42 +0000 Commit: John Baldwin <jhb@FreeBSD.org> CommitDate: 2026-07-31 17:52:42 +0000 kld: Reject kernel modules with PT_LOAD segments where filesz > memsz All sorts of places in the ELF loading code assume that filesz <= memsz, so check that explicitly up front. Reported by: Jane Smith <thebugfixers@pm.me> (via D57785) Reviewed by: jrtc27, kib Differential Revision: https://reviews.freebsd.org/D58542 --- sys/kern/link_elf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c index 6ab5f4a39580..d7aeefa25433 100644 --- a/sys/kern/link_elf.c +++ b/sys/kern/link_elf.c @@ -1110,6 +1110,14 @@ link_elf_load_file(linker_class_t cls, const char* filename, error = ENOEXEC; goto out; } + + if (phdr->p_memsz < phdr->p_filesz) { + link_elf_error(filename, + "Invalid program header"); + error = ENOEXEC; + goto out; + } + /* * XXX: We just trust they come in right order ?? */home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a6ce213.3e9e0.7622834f>