elf_validity_ehdr(9)

💅 elf_validity_ehdr(9) — like, the vibe check for ELF headers 😤✨

ok so real talk: this is from the Kernel API Manual, and it's the function that decides whether an ELF header is even allowed to be a module. bestie, it's the bouncer at the club 🎀

---

✨ SYNOPSIS ✨

int elf_validity_ehdr (const struct load_info *info );

---

🫶 ARGUMENTS 🫶

• info — the load info struct that's carrying the ELF header we're about to judge. it's giving "show me what you're working with" 💅

---

🌸 DESCRIPTION 🌸

okay so what this does is check whether an ELF header could legitimately belong to a valid module. like, is this actually a module or is it cosplaying as one 💀 it checks:

• the ELF header is actually inside the data the user handed over (no reaching outside the buffer, we don't do that here 🙈)
• the ELF magic is present ✨ (yes the magic bytes, iconic behavior)
• it's relocatable — so like, not final linked, not a core file, etc. 🎀
• the header's machine type matches what the architecture expects 👑
• there's an optional arch-specific hook for checking other properties 🦋

and a lil note on that last one: module_elf_check_arch is currently only used by PPC to check the ELF ABI version, but ngl, others might use it in the future 🌈 (that's literally what the docs say, i'm not making it up)

---

⭐ RETURN ⭐

0 if valid, -ENOEXEC on failure 😭

so yeah — zero means slay, -ENOEXEC means "not today, bestie" 💀

---

👑 SEE ALSO 👑

Kernel file ./kernel/module/main.c plus the whole friend group:

• find_any_unique_sec(9)
• is_module_percpu_address(9)
• module_refcount(9)
• verify_module_namespace(9)
• elf_validity_cache_sechdrs(9)
• elf_validity_cache_secstrings(9)
• elf_validity_cache_index_info(9)
• elf_validity_cache_index_mod(9)
• elf_validity_cache_index_sym(9)
• elf_validity_cache_index_str(9)
• elf_validity_cache_index_versions(9)
• elf_validity_cache_index(9)
• elf_validity_cache_strtab(9)
• is_module_address(9)
• __module_address(9)
• is_module_text_address(9)
• __module_text_address(9)

---

and that's the whole page, periodt 💖 this lil gem lives in ./kernel/module and the version is October 2026 — iykyk 🧚‍♀️✨