tree: https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git modules-next head: 8b1185a4427b772b9f02376a08272c3019777581 commit: 8b1185a4427b772b9f02376a08272c3019777581 [1/1] module: change to print useful messages from elf_validity_check() config: hexagon-randconfig-r036-20211013 (attached as .config) compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project b6a8c695542b2987eb9a203d5663a0740cb4725f) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git/commit/?... git remote add mcgrof https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux.git git fetch --no-tags mcgrof modules-next git checkout 8b1185a4427b772b9f02376a08272c3019777581 # save the attached .config to linux build tree COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 ARCH=hexagon If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <lkp(a)intel.com&gt; All warnings (new ones prefixed by >>): secend, shdr->sh_offset, secend, info->len); ^~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ sizeof(*(info->hdr))); ^~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ kernel/module.c:2995:34: warning: format specifies type 'unsigned long' but the argument has type 'unsigned int' [-Wformat] info->hdr->e_shentsize, sizeof(Elf_Shdr)); ^~~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ info->hdr->e_shnum * sizeof(Elf_Shdr), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ info->len - info->hdr->e_shoff); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ info->sechdrs[0].sh_type, info->sechdrs[0].sh_size, ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ info->sechdrs[0].sh_addr); ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/printk.h:489:33: note: expanded from macro 'pr_err' printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:446:60: note: expanded from macro 'printk' #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) ~~~ ^~~~~~~~~~~ include/linux/printk.h:418:19: note: expanded from macro 'printk_index_wrap' _p_func(_fmt, ##__VA_ARGS__); \ ~~~~ ^~~~~~~~~~~ 7 warnings generated. vim +2954 kernel/module.c 2942 2943 static int validate_section_offset(struct load_info *info, Elf_Shdr *shdr) 2944 { 2945 unsigned long secend; /* too short when sh_offset is Elf64_Off */ 2946 2947 /* 2948 * Check for both overflow and offset/size being 2949 * too large. 2950 */ 2951 secend = shdr->sh_offset + shdr->sh_size; 2952 if (secend < shdr->sh_offset || secend > info->len) { 2953 pr_err("Invalid ELF section offset/size: secend(%lu) < shdr->sh_offset(%llu) or secend(%lu) > e_shnum(%lu)\n", 2955 return -ENOEXEC; 2956 } 2957 2958 return 0; 2959 } 2960 2961 /* 2962 * Sanity checks against invalid binaries, wrong arch, weird elf version. 2963 * 2964 * Also do basic validity checks against section offsets and sizes, the 2965 * section name string table, and the indices used for it (sh_name). 2966 */ 2967 static int elf_validity_check(struct load_info *info) 2968 { 2969 unsigned int i; 2970 Elf_Shdr *shdr, *strhdr; 2971 int err; 2972 2973 if (info->len < sizeof(*(info->hdr))) { 2974 pr_err("Invalid ELF header len %lu < %lu\n", info->len, 2976 goto no_exec; 2977 } 2978 2979 if (memcmp(info->hdr->e_ident, ELFMAG, SELFMAG) != 0) { 2980 pr_err("Invalid ELF header magic: != %s\n", ELFMAG); 2981 goto no_exec; 2982 } 2983 if (info->hdr->e_type != ET_REL) { 2984 pr_err("Invalid ELF header type: %u != %u\n", 2985 info->hdr->e_type, ET_REL); 2986 goto no_exec; 2987 } 2988 if (!elf_check_arch(info->hdr)) { 2989 pr_err("Invalid architecture in ELF header: %u\n", 2990 info->hdr->e_machine); 2991 goto no_exec; 2992 } 2993 if (info->hdr->e_shentsize != sizeof(Elf_Shdr)) { 2994 pr_err("Invalid ELF section header size %d != %lu\n", 2995 info->hdr->e_shentsize, sizeof(Elf_Shdr)); 2996 goto no_exec; 2997 } 2998 2999 /* 3000 * e_shnum is 16 bits, and sizeof(Elf_Shdr) is 3001 * known and small. So e_shnum * sizeof(Elf_Shdr) 3002 * will not overflow unsigned long on any platform. 3003 */ 3004 if (info->hdr->e_shoff >= info->len 3005 || (info->hdr->e_shnum * sizeof(Elf_Shdr) > 3006 info->len - info->hdr->e_shoff)) { 3007 pr_err("Invalid ELF section header overflow: %ld > %llu\n", 3010 goto no_exec; 3011 } 3012 3013 info->sechdrs = (void *)info->hdr + info->hdr->e_shoff; 3014 3015 /* 3016 * Verify if the section name table index is valid. 3017 */ 3018 if (info->hdr->e_shstrndx == SHN_UNDEF 3019 || info->hdr->e_shstrndx >= info->hdr->e_shnum) { 3020 pr_err("Invalid ELF section name index: %d || e_shstrndx (%d) >= e_shnum (%d)\n", 3021 info->hdr->e_shstrndx, info->hdr->e_shstrndx, 3022 info->hdr->e_shnum); 3023 goto no_exec; 3024 } 3025 3026 strhdr = &info->sechdrs[info->hdr->e_shstrndx]; 3027 err = validate_section_offset(info, strhdr); 3028 if (err < 0) 3029 return err; 3030 3031 /* 3032 * The section name table must be NUL-terminated, as required 3033 * by the spec. This makes strcmp and pr_* calls that access 3034 * strings in the section safe. 3035 */ 3036 info->secstrings = (void *)info->hdr + strhdr->sh_offset; 3037 if (info->secstrings[strhdr->sh_size - 1] != '\0') { 3038 pr_err("ELF Spec violation: section name table isn't null terminated\n"); 3039 goto no_exec; 3040 } 3041 3042 /* 3043 * The code assumes that section 0 has a length of zero and 3044 * an addr of zero, so check for it. 3045 */ 3046 if (info->sechdrs[0].sh_type != SHT_NULL 3047 || info->sechdrs[0].sh_size != 0 3048 || info->sechdrs[0].sh_addr != 0) { 3049 pr_err("ELF Spec violation: section 0 type!=SH_NULL(%d) or non-zero len(%llu) or addr(%llu)\n", 3052 goto no_exec; 3053 } 3054 3055 for (i = 1; i < info->hdr->e_shnum; i++) { 3056 shdr = &info->sechdrs[i]; 3057 switch (shdr->sh_type) { 3058 case SHT_NULL: 3059 case SHT_NOBITS: 3060 continue; 3061 case SHT_SYMTAB: 3062 if (shdr->sh_link == SHN_UNDEF 3063 || shdr->sh_link >= info->hdr->e_shnum) { 3064 pr_err("Invalid ELF sh_link!=SHN_UNDEF(%d) or (sh_link(%d) >= hdr->e_shnum(%d)\n", 3065 shdr->sh_link, shdr->sh_link, 3066 info->hdr->e_shnum); 3067 goto no_exec; 3068 } 3069 fallthrough; 3070 default: 3071 err = validate_section_offset(info, shdr); 3072 if (err < 0) { 3073 pr_err("Invalid ELF section in module (section %u type %u)\n", 3074 i, shdr->sh_type); 3075 return err; 3076 } 3077 3078 if (shdr->sh_flags & SHF_ALLOC) { 3079 if (shdr->sh_name >= strhdr->sh_size) { 3080 pr_err("Invalid ELF section name in module (section %u type %u)\n", 3081 i, shdr->sh_type); 3082 return -ENOEXEC; 3083 } 3084 } 3085 break; 3086 } 3087 } 3088 3089 return 0; 3090 3091 no_exec: 3092 return -ENOEXEC; 3093 } 3094 --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org