kernel/module-verify.c

   1 /* module-verify.c: module verifier
   2  *
   3  * Written by David Howells (dhowells@redhat.com)
   4  *
   5  * This program is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU General Public License
   7  * as published by the Free Software Foundation; either version
   8  * 2 of the License, or (at your option) any later version.
   9  */
  10
  11 #include <linux/kernel.h>
  12 #include <linux/module.h>
  13 #include <linux/slab.h>
  14 #include <linux/elf.h>
  15 #include <linux/crypto.h>
  16 #include <linux/crypto/ksign.h>
  17 #include "module-verify.h"
  18
  19 #if 0
  20 #define _debug(FMT, ...) printk(FMT, ##__VA_ARGS__)
  21 #else
  22 #define _debug(FMT, ...) do {} while (0)
  23 #endif
  24
  25 static int module_verify_elf(struct module_verify_data *mvdata);
  26
  27 /*****************************************************************************/
  28 /*
  29  * verify a module's integrity
  30  * - check the ELF is viable
  31  * - check the module's signature if it has one
  32  */
  33 int module_verify(const Elf_Ehdr *hdr, size_t size)
  34 {
  35         struct module_verify_data mvdata;
  36         int ret;
  37
  38         memset(&mvdata, 0, sizeof(mvdata));
  39         mvdata.buffer   = hdr;
  40         mvdata.hdr      = hdr;
  41         mvdata.size     = size;
  42
  43         ret = module_verify_elf(&mvdata);
  44         if (ret < 0) {
  45                 if (ret == -ELIBBAD)
  46                         printk("Module failed ELF checks\n");
  47                 goto error;
  48         }
  49
  50 #ifdef CONFIG_MODULE_SIG
  51         ret = module_verify_signature(&mvdata);
  52 #endif
  53
  54  error:
  55         kfree(mvdata.secsizes);
  56         kfree(mvdata.canonlist);
  57         return ret;
  58
  59 } /* end module_verify() */
  60
  61 /*****************************************************************************/
  62 /*
  63  * verify the ELF structure of a module
  64  */
  65 static int module_verify_elf(struct module_verify_data *mvdata)
  66 {
  67         const Elf_Ehdr *hdr = mvdata->hdr;
  68         const Elf_Shdr *section, *section2, *secstop;
  69         const Elf_Rela *relas, *rela, *relastop;
  70         const Elf_Rel *rels, *rel, *relstop;
  71         const Elf_Sym *symbol, *symstop;
  72         size_t size, sssize, *secsize, tmp, tmp2;
  73         long last;
  74         int line;
  75
  76         size = mvdata->size;
  77         mvdata->nsects = hdr->e_shnum;
  78
  79 #define elfcheck(X) \
  80 do { if (unlikely(!(X))) { line = __LINE__; goto elfcheck_error; } } while(0)
  81
  82 #define seccheck(X) \
  83 do { if (unlikely(!(X))) { line = __LINE__; goto seccheck_error; } } while(0)
  84
  85 #define symcheck(X) \
  86 do { if (unlikely(!(X))) { line = __LINE__; goto symcheck_error; } } while(0)
  87
  88 #define relcheck(X) \
  89 do { if (unlikely(!(X))) { line = __LINE__; goto relcheck_error; } } while(0)
  90
  91 #define relacheck(X) \
  92 do { if (unlikely(!(X))) { line = __LINE__; goto relacheck_error; } } while(0)
  93
  94         /* validate the ELF header */
  95         elfcheck(hdr->e_ehsize < size);
  96         elfcheck(hdr->e_entry == 0);
  97         elfcheck(hdr->e_phoff == 0);
  98         elfcheck(hdr->e_phnum == 0);
  99
 100         elfcheck(hdr->e_shnum < SHN_LORESERVE);
 101         elfcheck(hdr->e_shoff < size);
 102         elfcheck(hdr->e_shoff >= hdr->e_ehsize);
 103         elfcheck((hdr->e_shoff & (sizeof(long) - 1)) == 0);
 104         elfcheck(hdr->e_shstrndx > 0);
 105         elfcheck(hdr->e_shstrndx < hdr->e_shnum);
 106         elfcheck(hdr->e_shentsize == sizeof(Elf_Shdr));
 107
 108         tmp = (size_t) hdr->e_shentsize * (size_t) hdr->e_shnum;
 109         elfcheck(tmp <= size - hdr->e_shoff);
 110
 111         /* allocate a table to hold in-file section sizes */
 112         mvdata->secsizes = kmalloc(hdr->e_shnum * sizeof(size_t), GFP_KERNEL);
 113         if (!mvdata->secsizes)
 114                 return -ENOMEM;
 115
 116         memset(mvdata->secsizes, 0, hdr->e_shnum * sizeof(size_t));
 117
 118         /* validate the ELF section headers */
 119         mvdata->sections = mvdata->buffer + hdr->e_shoff;
 120         secstop = mvdata->sections + mvdata->nsects;
 121
 122         sssize = mvdata->sections[hdr->e_shstrndx].sh_size;
 123         elfcheck(sssize > 0);
 124
 125         section = mvdata->sections;
 126         seccheck(section->sh_type == SHT_NULL);
 127         seccheck(section->sh_size == 0);
 128         seccheck(section->sh_offset == 0);
 129
 130         secsize = mvdata->secsizes + 1;
 131         for (section++; section < secstop; secsize++, section++) {
 132                 seccheck(section->sh_name < sssize);
 133                 seccheck(section->sh_link < hdr->e_shnum);
 134
 135                 if (section->sh_entsize > 0)
 136                         seccheck(section->sh_size % section->sh_entsize == 0);
 137
 138                 seccheck(section->sh_offset >= hdr->e_ehsize);
 139                 seccheck(section->sh_offset < size);
 140
 141                 /* determine the section's in-file size */
 142                 tmp = size - section->sh_offset;
 143                 if (section->sh_offset < hdr->e_shoff)
 144                         tmp = hdr->e_shoff - section->sh_offset;
 145
 146                 for (section2 = mvdata->sections + 1; section2 < secstop; section2++) {
 147                         if (section->sh_offset < section2->sh_offset) {
 148                                 tmp2 = section2->sh_offset - section->sh_offset;
 149                                 if (tmp2 < tmp)
 150                                         tmp = tmp2;
 151                         }
 152                 }
 153                 *secsize = tmp;
 154
 155                 _debug("Section %ld: %zx bytes at %lx\n",
 156                        section - mvdata->sections,
 157                        *secsize,
 158                        section->sh_offset);
 159
 160                 /* perform section type specific checks */
 161                 switch (section->sh_type) {
 162                 case SHT_NOBITS:
 163                         break;
 164
 165                 case SHT_REL:
 166                         seccheck(section->sh_entsize == sizeof(Elf_Rel));
 167                         goto more_rel_checks;
 168
 169                 case SHT_RELA:
 170                         seccheck(section->sh_entsize == sizeof(Elf_Rela));
 171                 more_rel_checks:
 172                         seccheck(section->sh_info > 0);
 173                         seccheck(section->sh_info < hdr->e_shnum);
 174                         goto more_sec_checks;
 175
 176                 case SHT_SYMTAB:
 177                         seccheck(section->sh_entsize == sizeof(Elf_Sym));
 178                         goto more_sec_checks;
 179
 180                 default:
 181                 more_sec_checks:
 182                         /* most types of section must be contained entirely
 183                          * within the file */
 184                         seccheck(section->sh_size <= *secsize);
 185                         break;
 186                 }
 187         }
 188
 189         /* validate the ELF section names */
 190         section = &mvdata->sections[hdr->e_shstrndx];
 191
 192         seccheck(section->sh_offset != hdr->e_shoff);
 193
 194         mvdata->secstrings = mvdata->buffer + section->sh_offset;
 195
 196         last = -1;
 197         for (section = mvdata->sections + 1; section < secstop; section++) {
 198                 const char *secname;
 199                 tmp = sssize - section->sh_name;
 200                 secname = mvdata->secstrings + section->sh_name;
 201                 seccheck(secname[0] != 0);
 202                 if (section->sh_name > last)
 203                         last = section->sh_name;
 204         }
 205
 206         if (last > -1) {
 207                 tmp = sssize - last;
 208                 elfcheck(memchr(mvdata->secstrings + last, 0, tmp) != NULL);
 209         }
 210
 211         /* look for various sections in the module */
 212         for (section = mvdata->sections + 1; section < secstop; section++) {
 213                 switch (section->sh_type) {
 214                 case SHT_SYMTAB:
 215                         if (strcmp(mvdata->secstrings + section->sh_name,
 216                                    ".symtab") == 0
 217                             ) {
 218                                 seccheck(mvdata->symbols == NULL);
 219                                 mvdata->symbols =
 220                                         mvdata->buffer + section->sh_offset;
 221                                 mvdata->nsyms =
 222                                         section->sh_size / sizeof(Elf_Sym);
 223                                 seccheck(section->sh_size > 0);
 224                         }
 225                         break;
 226
 227                 case SHT_STRTAB:
 228                         if (strcmp(mvdata->secstrings + section->sh_name,
 229                                    ".strtab") == 0
 230                             ) {
 231                                 seccheck(mvdata->strings == NULL);
 232                                 mvdata->strings =
 233                                         mvdata->buffer + section->sh_offset;
 234                                 sssize = mvdata->nstrings = section->sh_size;
 235                                 seccheck(section->sh_size > 0);
 236                         }
 237                         break;
 238                 }
 239         }
 240
 241         if (!mvdata->symbols) {
 242                 printk("Couldn't locate module symbol table\n");
 243                 goto format_error;
 244         }
 245
 246         if (!mvdata->strings) {
 247                 printk("Couldn't locate module strings table\n");
 248                 goto format_error;
 249         }
 250
 251         /* validate the symbol table */
 252         symstop = mvdata->symbols + mvdata->nsyms;
 253
 254         symbol = mvdata->symbols;
 255         symcheck(ELF_ST_TYPE(symbol[0].st_info) == STT_NOTYPE);
 256         symcheck(symbol[0].st_shndx == SHN_UNDEF);
 257         symcheck(symbol[0].st_value == 0);
 258         symcheck(symbol[0].st_size == 0);
 259
 260         last = -1;
 261         for (symbol++; symbol < symstop; symbol++) {
 262                 symcheck(symbol->st_name < sssize);
 263                 if (symbol->st_name > last)
 264                         last = symbol->st_name;
 265                 symcheck(symbol->st_shndx < mvdata->nsects ||
 266                          symbol->st_shndx >= SHN_LORESERVE);
 267         }
 268
 269         if (last > -1) {
 270                 tmp = sssize - last;
 271                 elfcheck(memchr(mvdata->strings + last, 0, tmp) != NULL);
 272         }
 273
 274         /* validate each relocation table as best we can */
 275         for (section = mvdata->sections + 1; section < secstop; section++) {
 276                 section2 = mvdata->sections + section->sh_info;
 277
 278                 switch (section->sh_type) {
 279                 case SHT_REL:
 280                         rels = mvdata->buffer + section->sh_offset;
 281                         relstop = mvdata->buffer + section->sh_offset + section->sh_size;
 282
 283                         for (rel = rels; rel < relstop; rel++) {
 284                                 relcheck(rel->r_offset < section2->sh_size);
 285                                 relcheck(ELF_R_SYM(rel->r_info) < mvdata->nsyms);
 286                         }
 287
 288                         break;
 289
 290                 case SHT_RELA:
 291                         relas = mvdata->buffer + section->sh_offset;
 292                         relastop = mvdata->buffer + section->sh_offset + section->sh_size;
 293
 294                         for (rela = relas; rela < relastop; rela++) {
 295                                 relacheck(rela->r_offset < section2->sh_size);
 296                                 relacheck(ELF_R_SYM(rela->r_info) < mvdata->nsyms);
 297                         }
 298
 299                         break;
 300
 301                 default:
 302                         break;
 303                 }
 304         }
 305
 306
 307         _debug("ELF okay\n");
 308         return 0;
 309
 310  elfcheck_error:
 311         printk("Verify ELF error (assertion %d)\n", line);
 312         goto format_error;
 313
 314  seccheck_error:
 315         printk("Verify ELF error [sec %ld] (assertion %d)\n",
 316                (long)(section - mvdata->sections), line);
 317         goto format_error;
 318
 319  symcheck_error:
 320         printk("Verify ELF error [sym %ld] (assertion %d)\n",
 321                (long)(symbol - mvdata->symbols), line);
 322         goto format_error;
 323
 324  relcheck_error:
 325         printk("Verify ELF error [sec %ld rel %ld] (assertion %d)\n",
 326                (long)(section - mvdata->sections),
 327                (long)(rel - rels), line);
 328         goto format_error;
 329
 330  relacheck_error:
 331         printk("Verify ELF error [sec %ld rela %ld] (assertion %d)\n",
 332                (long)(section - mvdata->sections),
 333                (long)(rela - relas), line);
 334         goto format_error;
 335
 336  format_error:
 337         return -ELIBBAD;
 338
 339 } /* end module_verify_elf() */