On Sat 07-06-25 13:58:44, Pranav Tyagi wrote: > Use check_mul_overflow() to safely compute the total size of ELF program > headers instead of relying on direct multiplication. > > Directly multiplying sizeof(struct elf_phdr) with e_phnum risks integer > overflow, especially on 32-bit systems or with malformed ELF binaries > crafted to trigger wrap-around. If an overflow occurs, kmalloc() could > allocate insufficient memory, potentially leading to out-of-bound > accesses, memory corruption or security vulnerabilities. > > Using check_mul_overflow() ensures the multiplication is performed > safely and detects overflows before memory allocation. This change makes > the function more robust when handling untrusted or corrupted binaries. > > Signed-off-by: Pranav Tyagi <pranav.tyagi03@xxxxxxxxx> > Link: https://github.com/KSPP/linux/issues/92 Looks good. Feel free to add: Reviewed-by: Jan Kara <jack@xxxxxxx> Honza > --- > fs/binfmt_elf.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > index a43363d593e5..774e705798b8 100644 > --- a/fs/binfmt_elf.c > +++ b/fs/binfmt_elf.c > @@ -518,7 +518,10 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, > > /* Sanity check the number of program headers... */ > /* ...and their total size. */ > - size = sizeof(struct elf_phdr) * elf_ex->e_phnum; > + > + if (check_mul_overflow(sizeof(struct elf_phdr), elf_ex->e_phnum, &size)) > + goto out; > + > if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN) > goto out; > > -- > 2.49.0 > -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR
