Page MenuHomeFreeBSD
Differential D57785

link_elf: Guard against subtraction underflow
AbandonedPublic
Actions

Authored by jhb on Jun 23 2026, 8:30 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Sep 26, 5:02 AM
Unknown Object (File)
Thu, Sep 24, 9:25 AM
Unknown Object (File)
Wed, Sep 23, 2:35 PM
Unknown Object (File)
Tue, Sep 22, 12:48 PM
Unknown Object (File)
Thu, Sep 17, 9:47 AM
Unknown Object (File)
Wed, Sep 16, 3:13 PM
Unknown Object (File)
Sat, Sep 5, 7:32 PM
Unknown Object (File)
Sat, Sep 5, 7:32 PM
View All 57 Files
Subscribers
imp
jhb
olce

Details

Reviewers
thebugfixers_pm.me
Group Reviewers
Src Committers
Contributor Reviews (src)
Summary

If a malformed program header has p_filesz > p_memsz, the subtraction underflows.
Introduced guard to validate before zeroing.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

thebugfixers_pm.me created this revision.Jun 23 2026, 8:30 PM
Herald added subscribers: olce, imp. · View Herald TranscriptJun 23 2026, 8:30 PM
thebugfixers_pm.me requested review of this revision.Jun 23 2026, 8:30 PM
thebugfixers_pm.me added child revisions: D57786: link_elf: Guard against out‑of‑bounds read of shdr[shstrindex], D57788: link_elf: Program-header bounds check is non‑fatal (link_elf_load_file), D57808: link_elf: elf_set_add assertion accepts partial overlaps, D57809: link_elf: Guard against multiplication overflow, D57810: link_elf: Unvalidated string‑table offset (link_elf_lookup_symbol1), D57811: link_elf: Uncapped dynamic-section walk (parse_dynamic).Jun 26 2026, 5:25 PM
jhb added a subscriber: jhb.Jul 29 2026, 2:01 PM

For this case, I would rather abort the link attempt and treat this as a corrupt file. In fact, several other things break here before we even get to the bzero if filesz > memsz. Rather than this change, I'll be fixing various ELF loaders in the tree to reject files where filesz > memsz.

jhb mentioned this in D58542: kld: Reject kernel modules with PT_LOAD segments where filesz > memsz.Jul 29 2026, 7:23 PM
jhb added a comment.Jul 29 2026, 8:45 PM

See D58542 (and related commits in that stack)

jhb mentioned this in rG486dfbb67e09: kld: Reject kernel modules with PT_LOAD segments where filesz > memsz.Jul 31 2026, 5:58 PM
jhb commandeered this revision.Aug 1 2026, 8:23 PM
jhb abandoned this revision.
jhb added a reviewer: thebugfixers_pm.me.

Revision Contents
Changeset List

PathSize
sys/
kern/
5 lines

Diff 180449

View Options

sys/kern/link_elf.c

Loading...