Page MenuHomeFreeBSD
Differential D57785

link_elf: Guard against subtraction underflow
AbandonedPublic
Actions

Authored by jhb on Jun 23 2026, 8:30 PM.
Tags
None
Referenced Files
F166350629: D57785.diff
Thu, Aug 13, 1:41 AM
Unknown Object (File)
Mon, Aug 10, 1:05 PM
Unknown Object (File)
Sun, Aug 9, 3:38 AM
Unknown Object (File)
Sat, Aug 8, 10:23 PM
Unknown Object (File)
Sat, Aug 8, 5:43 PM
Unknown Object (File)
Sat, Aug 8, 11:41 AM
Unknown Object (File)
Sat, Aug 8, 5:30 AM
Unknown Object (File)
Fri, Aug 7, 11:41 AM
View All 46 Files
Subscribers
imp
jhb
olce

Details

Reviewers
thebugfixers_pm.me
Group Reviewers
Src Committers
Contributor Reviews (src)
Summary

If a malformed program header has p_filesz > p_memsz, the subtraction underflows.
Introduced guard to validate before zeroing.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

thebugfixers_pm.me created this revision.Jun 23 2026, 8:30 PM
Herald added subscribers: olce, imp. · View Herald TranscriptJun 23 2026, 8:30 PM
thebugfixers_pm.me requested review of this revision.Jun 23 2026, 8:30 PM
thebugfixers_pm.me added child revisions: D57786: link_elf: Guard against out‑of‑bounds read of shdr[shstrindex], D57788: link_elf: Program-header bounds check is non‑fatal (link_elf_load_file), D57808: link_elf: elf_set_add assertion accepts partial overlaps, D57809: link_elf: Guard against multiplication overflow, D57810: link_elf: Unvalidated string‑table offset (link_elf_lookup_symbol1), D57811: link_elf: Uncapped dynamic-section walk (parse_dynamic).Jun 26 2026, 5:25 PM
jhb added a subscriber: jhb.Wed, Jul 29, 2:01 PM

For this case, I would rather abort the link attempt and treat this as a corrupt file. In fact, several other things break here before we even get to the bzero if filesz > memsz. Rather than this change, I'll be fixing various ELF loaders in the tree to reject files where filesz > memsz.

jhb mentioned this in D58542: kld: Reject kernel modules with PT_LOAD segments where filesz > memsz.Wed, Jul 29, 7:23 PM
jhb added a comment.Wed, Jul 29, 8:45 PM

See D58542 (and related commits in that stack)

jhb mentioned this in rG486dfbb67e09: kld: Reject kernel modules with PT_LOAD segments where filesz > memsz.Fri, Jul 31, 5:58 PM
jhb commandeered this revision.Sat, Aug 1, 8:23 PM
jhb abandoned this revision.
jhb added a reviewer: thebugfixers_pm.me.

Revision Contents
Changeset List

PathSize
sys/
kern/
5 lines

Diff 180449

View Options

sys/kern/link_elf.c

Loading...