diff --git a/kernel/module/main.c b/kernel/module/main.c index d0e1e0bd2ad06b..30c7a05488bc35 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -1933,6 +1933,7 @@ static int elf_validity_ehdr(const struct load_info *info) * * Section array fits in the user provided data * * Section index 0 is NULL * * Section contents are inbounds + * * Relocation section target indices are inbounds * * Then updates @info with a &load_info->sechdrs pointer if valid. * @@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info *info) /* Validate contents are inbounds */ for (i = 1; i < info->hdr->e_shnum; i++) { shdr = &sechdrs[i]; + if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) && + shdr->sh_info >= info->hdr->e_shnum) { + pr_err("Invalid ELF relocation section target index %u\n", + shdr->sh_info); + return -ENOEXEC; + } switch (shdr->sh_type) { case SHT_NULL: case SHT_NOBITS: