From nobody Fri Oct 09 00:20:49 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j16w20KZHz6Z20n for ; Fri, 09 Oct 2026 00:20:50 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j16w15VLBz4M1j for ; Fri, 09 Oct 2026 00:20:49 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791505249; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CS/eIogoQCCoV1Gi2KB6jlYFboES2y36WfynQjvqkyM=; b=vSD2ghMDLncQv+Dm6t6qTxRPJRy3fkQi96Dc0ICQ2aodD0eoeAYO/2wddkzvBNc/ZKJTHf 23s/2sVSJWKOxuLUdtA5BWv/O6VMrbn+6ulqndJLI8LvHUHyjLs4MU70zlaTHkt/eZdcdb 8W8rNtShZ9w14Pjveu5nzBdLkzvcQnVc5TfmxTSwy/BAvIrdm2HEKo6ukwivHEhhBUAS9l LBD9FRATo92hKd1uSTpuK3bS1IPxu5Pzhe/cQqz6QCcXC7XmmZRGsagWC/zWwqSqadqmEX FbI6cMJEmRga3bHLeagO/Gz8oCP3cgJFbpDlXWQRbiUVtng0+fM7jdcNG4sYSQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791505249; b=CruKx5oyPbubhTE6wY+2l40vr8v1BTt+cVyFOqj74miw6zL07dZrgug2Mk07x7///tq9Du jYUc0zqytyj2EJIta7t+rT8Fca8VQ0S5mlXI86fDNlpBt/tL61sLaCHmMQesDaxtgVdWRD Kbhhvh5EaDUAYucrT9tnGKV6hqflhdn7niXPsRpwPolT4v82Ed0EGG4bMOxGgTJZnciFbR 3fwkAEBKBBKrtn/WqA1n/kkQyc/YbGV/WMxem5dTHiLH52sCxISWK8UGKY2R7LCG/vUuAH xhNwVJdPCl6goEn8Z7FXvMYR/WbvcImSQmXhKHebNzfNedCHjWgDobovbtzVrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791505249; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=CS/eIogoQCCoV1Gi2KB6jlYFboES2y36WfynQjvqkyM=; b=dqxiDX1gt96y1EVNkdKTH8b0baPvo3tcnnJ3ZQAEK0XyE6GOus3j6OjH9/m76saHDJ42Y/ p4I/KT2MC+7FqFLGRVsKqOF6dHXXn+0Ra1ulC0qwIEmwTLKgrG5sd0x1Fkc62sn0r2qT3Q a0O7x1+j5gYMFwoxhPVSJ7vdzRNiGqG3D6VivwzGZjS2vrgje67/KiEbRzBPJXYbmsSTa8 URTGVgS0lIXM1h3wXTS9AYMglEaCaPJ/6Qcd2bxNiyE3HT96dBndLT9juCxVLkhgOJe57z XU4gOCSScK0v+IXJPsiKozbZA1EvYlEuyE9o1u2myN34a9SoKC3mBhU3hKJljQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j16w14PR0z1359 for ; Fri, 09 Oct 2026 00:20:49 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1954e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 09 Oct 2026 00:20:49 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: John Baldwin Subject: git: a72d720838d2 - stable/14 - kld: Reject kernel modules with PT_LOAD segments where filesz > memsz List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jhb X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: a72d720838d20ef3b51756ee53e49c66cd0b324b Auto-Submitted: auto-generated Date: Fri, 09 Oct 2026 00:20:49 +0000 Message-Id: <6ac83361.1954e.592dce8c@gitrepo.freebsd.org> The branch stable/14 has been updated by jhb: URL: https://cgit.FreeBSD.org/src/commit/?id=a72d720838d20ef3b51756ee53e49c66cd0b324b commit a72d720838d20ef3b51756ee53e49c66cd0b324b Author: John Baldwin AuthorDate: 2026-07-31 17:52:42 +0000 Commit: John Baldwin CommitDate: 2026-10-08 18:47:42 +0000 kld: Reject kernel modules with PT_LOAD segments where filesz > memsz All sorts of places in the ELF loading code assume that filesz <= memsz, so check that explicitly up front. Reported by: Jane Smith (via D57785) Reviewed by: jrtc27, kib Differential Revision: https://reviews.freebsd.org/D58542 (cherry picked from commit 486dfbb67e093a461a5ebd97f66be9b345f9de77) --- sys/kern/link_elf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c index 18826b7a6360..04281a7efd08 100644 --- a/sys/kern/link_elf.c +++ b/sys/kern/link_elf.c @@ -1086,6 +1086,14 @@ link_elf_load_file(linker_class_t cls, const char* filename, error = ENOEXEC; goto out; } + + if (phdr->p_memsz < phdr->p_filesz) { + link_elf_error(filename, + "Invalid program header"); + error = ENOEXEC; + goto out; + } + /* * XXX: We just trust they come in right order ?? */