On Tue, Jun 10, 2025 at 1:29 PM Jan Kara <jack@xxxxxxx> wrote: > > On Mon 09-06-25 21:04:36, Kees Cook wrote: > > On Sat, Jun 07, 2025 at 01:58:44PM +0530, Pranav Tyagi wrote: > > > Use check_mul_overflow() to safely compute the total size of ELF program > > > headers instead of relying on direct multiplication. > > > > > > Directly multiplying sizeof(struct elf_phdr) with e_phnum risks integer > > > overflow, especially on 32-bit systems or with malformed ELF binaries > > > crafted to trigger wrap-around. If an overflow occurs, kmalloc() could > > > allocate insufficient memory, potentially leading to out-of-bound > > > accesses, memory corruption or security vulnerabilities. > > > > > > Using check_mul_overflow() ensures the multiplication is performed > > > safely and detects overflows before memory allocation. This change makes > > > the function more robust when handling untrusted or corrupted binaries. > > > > > > Signed-off-by: Pranav Tyagi <pranav.tyagi03@xxxxxxxxx> > > > Link: https://github.com/KSPP/linux/issues/92 > > > --- > > > fs/binfmt_elf.c | 5 ++++- > > > 1 file changed, 4 insertions(+), 1 deletion(-) > > > > > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c > > > index a43363d593e5..774e705798b8 100644 > > > --- a/fs/binfmt_elf.c > > > +++ b/fs/binfmt_elf.c > > > @@ -518,7 +518,10 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex, > > > > > > /* Sanity check the number of program headers... */ > > > /* ...and their total size. */ > > > - size = sizeof(struct elf_phdr) * elf_ex->e_phnum; > > > > size is unsigned int, which has a maximum value of 4,294,967,295. > > > > elf_ex->e_phnum is a u16 (2 bytes) and will not be changing: > > > > $ pahole -C elf64_hdr */fs/binfmt_elf.o > > struct elf64_hdr { > > ... > > Elf64_Half e_phnum; /* 56 2 */ > > ... > > Ah, what confused me was that I somehow thought Elf64_Half is u32 without > checking it's definition which clearly shows its actually u16. Thanks for > checking it! You're right that the patch is pointless then. > > Honza > -- > Jan Kara <jack@xxxxxxxx> > SUSE Labs, CR Hi, I understand that the patch is actually pointless. I am still new to kernel dev and learnt a lot from your comments. I will keep this in mind while sending patches in the future. Regards Pranav Tyagi
