From 028643199495f67de40d65ec8c45aed6ffd3b472 Mon Sep 17 00:00:00 2001 From: Karl Mehltretter Date: Wed, 9 Sep 2026 01:08:15 +0200 Subject: [PATCH] module: reject out-of-range relocation target indices apply_relocations() skips relocation sections whose sh_info target index is outside the section table. ARM, ARM64, LoongArch, PA-RISC and RISC-V use sh_info earlier in module_frob_arch_sections(), before this check. ARM, ARM64, LoongArch and RISC-V use the unchecked index to read sh_flags outside the section header table. PA-RISC uses it to index an e_shnum-sized heap array for a read and an update. QEMU reproduced page-fault Oopses on ARM, ARM64, LoongArch and RISC-V, and a Data TLB miss on the PA-RISC array read. Validate sh_info for SHT_REL and SHT_RELA sections in elf_validity_cache_sechdrs(). Reject the module with ENOEXEC before architecture code can use the index. Fixes: c298be74492b ("parisc: fix module loading failure of large kernel modules") Fixes: 7d485f647c1f ("ARM: 8220/1: allow modules outside of bl range") Fixes: fd045f6cd98e ("arm64: add support for module PLTs") Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module") Fixes: fcdfe9d22bed ("LoongArch: Add ELF and module support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Linux RISC-V bot --- kernel/module/main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/module/main.c b/kernel/module/main.c index d0e1e0bd2ad06b..30c7a05488bc35 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -1933,6 +1933,7 @@ static int elf_validity_ehdr(const struct load_info *info) * * Section array fits in the user provided data * * Section index 0 is NULL * * Section contents are inbounds + * * Relocation section target indices are inbounds * * Then updates @info with a &load_info->sechdrs pointer if valid. * @@ -1983,6 +1984,12 @@ static int elf_validity_cache_sechdrs(struct load_info *info) /* Validate contents are inbounds */ for (i = 1; i < info->hdr->e_shnum; i++) { shdr = &sechdrs[i]; + if ((shdr->sh_type == SHT_REL || shdr->sh_type == SHT_RELA) && + shdr->sh_info >= info->hdr->e_shnum) { + pr_err("Invalid ELF relocation section target index %u\n", + shdr->sh_info); + return -ENOEXEC; + } switch (shdr->sh_type) { case SHT_NULL: case SHT_NOBITS: