From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA9592236E8 for ; Mon, 12 Jan 2026 14:37:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768228629; cv=none; b=bzkIMq3XJFItEPk/zh+YA53nFsCH8eeyo2q2XUEo5pGj4J9zQONRxPVMqYN0yY+v0yKJGqBukjOJpEd8pzQPRUGloRNiKb5pdi/2dIeKTIIIUek0WQ1HiEQJCKllT6py1DL2dJ6JgQY7D6BvnlPGIRxzwZsLvDRxrDz9uxApArw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768228629; c=relaxed/simple; bh=iyqqznUqDL99OwJCEkrsF2iVykllrm4FsNPCyAuRMwE=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=DF1VDTtqBUN3e70yJBBtPRgiJAHrtOY2IJDqeK7VYpT2d8qQ0MQg2rp2+V35rEFVZqF3RdTnpOaxIVR+sck8k3Q9OqWWRgDAaeYi6a0TnUmhS4s+86XBBZ5SKvh+bnfSWSyi09yIuxLtjqykJDz7oCC4WC3QHZhqeEVKFcBQzPc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=HxKCXCEn; arc=none smtp.client-ip=209.85.221.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="HxKCXCEn" Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-42fb6ce71c7so5481881f8f.1 for ; Mon, 12 Jan 2026 06:37:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1768228626; x=1768833426; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=Gusj9aT7RaX3C9uGASncaxKiTRdOev9W3ScVaZSC4iY=; b=HxKCXCEnI49Qz4IQaghPBJuui1rlMR6Novwc99GHqU+DzA2GaaTSHU0BmrzVdrjoR0 eaJfAzUC0RPWV3NJ3dAm7K4H5ny9qutM5lWev7HR6nAwHlWZ222AgweMPQO1Pk4ZQ2/c 927hsXyAyGVY5f9lK0+0f5jSUCbYNy+Q+zvBu1EG//K7ZGUb0WZAj8LIpQJEuaYR0xGr S/ADOD4neNCly69JA/OBFTtTVbHlCYWBXvPAD40FLZRPusoLLzlNVgM4hYtl7lA3HcSf Ew0d2xha43Q3Zw25P0OfIN5XwuIZDFWAF751T2FBGekiJw+zOfXVAX2cnH7DpNk0CKmM 9XXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768228626; x=1768833426; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Gusj9aT7RaX3C9uGASncaxKiTRdOev9W3ScVaZSC4iY=; b=ikMdMDgBLX10k7sWCz4DQBLSIv1HQ+A5bYeClPJn/aZUXodSNtX7JyLNzqlN0DWHV9 oC+jp7tjJQv/pA8XB0M3h5Z+mqcCKQJlhVYZHVUDqWC++8+yRr/ZeQq83PAQ3znpMgBY 1+nRYRBzfUns+LvJIU35C3jUjEs8z6c4tlKsiIw4i4docLVMxbfBq4IQvUJxgw8XOSgx kZixxFBAYrJCsaWOQ5Wdn/2uq07RMwhDGh+Q4Ve4sOghkuHVKaGiMns6xRVXmIp7p1hI 5NI55OFj4qO3Cl5HCF6NLVDOtZ5/ct5aYEtf42K9mKh7j4BX9ir8KWZXsfLibk5WqKzE qMDQ== X-Forwarded-Encrypted: i=1; AJvYcCUSNx9nAhwUQ2J91sHuLvh6jVPzexOi9TXub9RPUobH8zcXF38jw/RNQfAt7QtZz1AbUZPV7bllMFb9HhU=@vger.kernel.org X-Gm-Message-State: AOJu0YyMjPb8FnohV21XtnXJnELFEsIqJOPGrwZyFpmvU3ZHd2z7tu0+ 6X7gIF0gIGFkn0l/LJhtrSXOi1tx/B7mmFMU7BMSpnodb0tpVZ7x/NuovZjzQ2hpYA0= X-Gm-Gg: AY/fxX4McXdY3xof0ZElmOORxHJlQMwCrKH4wf5dWBdZWOrKC3eUxFCpbL4BxDanFlK AkoTk7rauPGlwKXL8wtFuWJp2vL3U9iRrETeZyMXqYpOT+oUe5umV/g0khQp+EpNC/ZbBqtlk+b a0AaKYB9UFsnqhIbTxoZqHmXk42Km+3f0UIGGodXTOz8jXkBijkkyEQoH8xRMW2mZvbbl/bNLvQ uy17+1riifOw4HzY9rP4LBzZfBbcbG/7WXDkuyLIvGl0wcdI3Enh1Lo77CliiKa/zOYZh6yDqH/ ByvxJwiE48+RvThaYBwEv3oMgZXaJhwDlVD7/VvSMg5P43u28d3x9yBWkKeVHdOLLhM9IXj+srH 3gidtaG+Ovpo2s91VTiJZlwAKAT6+8+v5eroRHnAcMQFasb+R5jjFSqhgtsfADNNge9lsvyx40K SPwVrtD+JQMZ/yyy89K6cVt2m2nQG/nw== X-Google-Smtp-Source: AGHT+IFmm1oEKKdZV8ZlNXFTTJqlKJkxSdN4HcGz/P7O+LQJVZm9Zz54Me3GJnG5+SbV8c+kl57MWg== X-Received: by 2002:a5d:5f94:0:b0:432:5bac:3915 with SMTP id ffacd0b85a97d-432c37c87e4mr21260896f8f.39.1768228625843; Mon, 12 Jan 2026 06:37:05 -0800 (PST) Received: from [10.0.1.22] (109-81-1-107.rct.o2.cz. [109.81.1.107]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-432bd5ff0b2sm38877725f8f.42.2026.01.12.06.37.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 12 Jan 2026 06:37:05 -0800 (PST) Message-ID: Date: Mon, 12 Jan 2026 15:37:04 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] module: Fix kernel panic when a symbol st_shndx is out of bounds To: Ihor Solodrai Cc: Luis Chamberlain , Daniel Gomez , Nathan Chancellor , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , linux-kernel@vger.kernel.org, linux-modules@vger.kernel.org, bpf@vger.kernel.org, linux-kbuild@vger.kernel.org, llvm@lists.linux.dev References: <20251230183208.1317279-1-ihor.solodrai@linux.dev> Content-Language: en-US From: Petr Pavlu In-Reply-To: <20251230183208.1317279-1-ihor.solodrai@linux.dev> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 12/30/25 7:32 PM, Ihor Solodrai wrote: > The module loader doesn't check for bounds of the ELF section index in > simplify_symbols(): > > for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) { > const char *name = info->strtab + sym[i].st_name; > > switch (sym[i].st_shndx) { > case SHN_COMMON: > > [...] > > default: > /* Divert to percpu allocation if a percpu var. */ > if (sym[i].st_shndx == info->index.pcpu) > secbase = (unsigned long)mod_percpu(mod); > else > /** HERE --> **/ secbase = info->sechdrs[sym[i].st_shndx].sh_addr; > sym[i].st_value += secbase; > break; > } > } > > A symbol with an out-of-bounds st_shndx value, for example 0xffff > (known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic: > > BUG: unable to handle page fault for address: ... > RIP: 0010:simplify_symbols+0x2b2/0x480 > ... > Kernel panic - not syncing: Fatal exception > > This can happen when module ELF is legitimately using SHN_XINDEX or > when it is corrupted. > > Add a bounds check in simplify_symbols() to validate that st_shndx is > within the valid range before using it. > > This issue was discovered due to a bug in llvm-objcopy, see relevant > discussion for details [1]. > > [1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/ > > Signed-off-by: Ihor Solodrai Reviewed-by: Petr Pavlu -- Thanks, Petr