[PATCH] cfi: Ignore non-allocated module trap sections

[Laxman Acharya Padhya]

rewrite_section_headers() initially sets sh_addr for every section to its
address in the temporary module image. Only SHF_ALLOC sections are later
copied to module memory and have sh_addr updated.

module_cfi_finalize() accepts any section named __kcfi_traps. A malformed
module can therefore leave mod->kcfi_traps pointing into the temporary
image, which is freed after loading. A later CFI trap would then scan freed
memory.

Require the trap section to be allocated before retaining its address.
Clang emits .kcfi_traps with SHF_ALLOC, so valid modules are unchanged.

Fixes: 89245600941e ("cfi: Switch to -fsanitize=kcfi")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>
---
 kernel/cfi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/cfi.c b/kernel/cfi.c
index 4dad04ead06c..3ee67b723ab4 100644
--- a/kernel/cfi.c
+++ b/kernel/cfi.c
@@ -74,7 +74,8 @@ void module_cfi_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
 	secstrings = (char *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
 
 	for (i = 1; i < hdr->e_shnum; i++) {
-		if (strcmp(secstrings + sechdrs[i].sh_name, "__kcfi_traps"))
+		if (strcmp(secstrings + sechdrs[i].sh_name, "__kcfi_traps") ||
+		    !(sechdrs[i].sh_flags & SHF_ALLOC))
 			continue;
 
 		mod->kcfi_traps = (s32 *)sechdrs[i].sh_addr;
-- 
2.51.2