aboutsummaryrefslogtreecommitdiff
path: root/kernel/module.c
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2012-05-22 15:56:13 +0100
committerRusty Russell <rusty@rustcorp.com.au>2012-05-23 22:28:53 +0930
commitef26a5a6eadb7cd0637e1e9e246cd42505b8ec8c (patch)
tree94f8b1998d94080a842f94529f0d95cfe1bcc53a /kernel/module.c
parent3c7ec94d2c4a67d9663a080aa5080134308261c4 (diff)
downloadlinaro-lsk-ef26a5a6eadb7cd0637e1e9e246cd42505b8ec8c.tar.gz
Guard check in module loader against integer overflow
The check: if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) may not work if there's an overflow in the right-hand side of the condition. Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Diffstat (limited to 'kernel/module.c')
-rw-r--r--kernel/module.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/module.c b/kernel/module.c
index a4e60973ca7..4edbd9c11ac 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2429,7 +2429,8 @@ static int copy_and_check(struct load_info *info,
goto free_hdr;
}
- if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) {
+ if (hdr->e_shoff >= len ||
+ hdr->e_shnum * sizeof(Elf_Shdr) > len - hdr->e_shoff) {
err = -ENOEXEC;
goto free_hdr;
}