git: 999ce4475a01 - stable/15 - kld: Reject kernel modules with PT_LOAD segments where filesz > memsz

The branch stable/15 has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=999ce4475a0199577e5b08fce12624df0e38d0c6

commit 999ce4475a0199577e5b08fce12624df0e38d0c6
Author:     John Baldwin <jhb@FreeBSD.org>
AuthorDate: 2026-07-31 17:52:42 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-10-08 20:42:32 +0000

    kld: Reject kernel modules with PT_LOAD segments where filesz > memsz
    
    All sorts of places in the ELF loading code assume that filesz <=
    memsz, so check that explicitly up front.
    
    Reported by:    Jane Smith <thebugfixers@pm.me> (via D57785)
    Reviewed by:    jrtc27, kib
    Differential Revision:  https://reviews.freebsd.org/D58542
    
    (cherry picked from commit 486dfbb67e093a461a5ebd97f66be9b345f9de77)
---
 sys/kern/link_elf.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c
index ef4609333d3d..e6301691affa 100644
--- a/sys/kern/link_elf.c
+++ b/sys/kern/link_elf.c
@@ -1110,6 +1110,14 @@ link_elf_load_file(linker_class_t cls, const char* filename,
 				error = ENOEXEC;
 				goto out;
 			}
+
+			if (phdr->p_memsz < phdr->p_filesz) {
+				link_elf_error(filename,
+				    "Invalid program header");
+				error = ENOEXEC;
+				goto out;
+			}
+
 			/*
 			 * XXX: We just trust they come in right order ??
 			 */