github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

remoteproc: elf_loader: Bound the section header table

Browse Source 
The rproc_elf_sanity_check() only checks the image is big enough to hold
one section header. But find_table() walks e_shnum of them, and first
dereferences the header at e_shstrndx to locate the section name table.
Both fields are u16 and both come from the image, so an e_shstrndx of
65535 reads about 4 MB past the buffer.

The commit 9f9967fed9 ("soc: qcom: mdt_loader: Ensure we don't read
past the ELF header") added the same check to the MDT loader, and says
the header "is sanitized beforehand" under remoteproc. That is what this
patch makes true.

Check e_shoff against the image size first, so the two bounds can use
size_add() without an e_shoff above SIZE_MAX wrapping on 32-bit. The
bounds are separate because e_shnum may be zero while find_table() still
reads the e_shstrndx header.

Fixes: 400e64df6b ("remoteproc: add framework for controlling remote processors")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260724025322.2341205-1-sammiee5311@gmail.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
This commit is contained in:
HyeongJun An 2026-07-24 11:53:22 +09:00 committed by Mathieu Poirier
parent f559ef6316
commit b32177ead5
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
drivers/remoteproc/remoteproc_elf_loader.c
View File

@ -46,8 +46,9 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
struct elf32_hdr *ehdr;
u32 elf_shdr_get_size;
u64 phoff, shoff;
size_t shend;
char class;
u16 phnum;
u16 phnum, shnum, shstrndx;
if (!fw) {
dev_err(dev, "failed to load %s\n", name);
@ -90,9 +91,27 @@ int rproc_elf_sanity_check(struct rproc *rproc, const struct firmware *fw)
phoff = elf_hdr_get_e_phoff(class, fw->data);
shoff = elf_hdr_get_e_shoff(class, fw->data);
phnum = elf_hdr_get_e_phnum(class, fw->data);
shnum = elf_hdr_get_e_shnum(class, fw->data);
shstrndx = elf_hdr_get_e_shstrndx(class, fw->data);
elf_shdr_get_size = elf_size_of_shdr(class);
if (fw->size < shoff + elf_shdr_get_size) {
/* keeps shoff in size_t range for the two bounds below */
if (shoff > fw->size) {
dev_err(dev, "Section header table is out of bounds\n");
return -EINVAL;
}
if (shnum) {
shend = size_add(size_mul(elf_shdr_get_size, shnum), shoff);
if (shend > fw->size) {
dev_err(dev, "Section headers are out of bounds\n");
return -EINVAL;
}
}
/* find_table() reads the header at shstrndx even with no sections */
shend = size_add(size_mul(elf_shdr_get_size, (size_t)shstrndx + 1), shoff);
if (shend > fw->size) {
dev_err(dev, "Image is too small\n");
return -EINVAL;
}