linux-kernel - Re: [PATCH] binfmt_elf: use check_mul

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <j7qo6dmmx2hu34453zfdp6rjrtlsyckjilm6qufe2qyj4dc6ei@su6omrup5rli>
Date: Mon, 9 Jun 2025 13:25:17 +0200
From: Jan Kara <jack@...e.cz>
To: Pranav Tyagi <pranav.tyagi03@...il.com>
Cc: viro@...iv.linux.org.uk, brauner@...nel.org, jack@...e.cz, 
	kees@...nel.org, linux-fsdevel@...r.kernel.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, skhan@...uxfoundation.org, linux-kernel-mentees@...ts.linux.dev
Subject: Re: [PATCH] binfmt_elf: use check_mul_overflow() for size calc

On Sat 07-06-25 13:58:44, Pranav Tyagi wrote:
> Use check_mul_overflow() to safely compute the total size of ELF program
> headers instead of relying on direct multiplication.
> 
> Directly multiplying sizeof(struct elf_phdr) with e_phnum risks integer
> overflow, especially on 32-bit systems or with malformed ELF binaries
> crafted to trigger wrap-around. If an overflow occurs, kmalloc() could
> allocate insufficient memory, potentially leading to out-of-bound
> accesses, memory corruption or security vulnerabilities.
> 
> Using check_mul_overflow() ensures the multiplication is performed
> safely and detects overflows before memory allocation. This change makes
> the function more robust when handling untrusted or corrupted binaries.
> 
> Signed-off-by: Pranav Tyagi <pranav.tyagi03@...il.com>
> Link: https://github.com/KSPP/linux/issues/92

Looks good. Feel free to add:

Reviewed-by: Jan Kara <jack@...e.cz>

								Honza

> ---
>  fs/binfmt_elf.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index a43363d593e5..774e705798b8 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -518,7 +518,10 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
>  
>  	/* Sanity check the number of program headers... */
>  	/* ...and their total size. */
> -	size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
> +	
> +	if (check_mul_overflow(sizeof(struct elf_phdr), elf_ex->e_phnum, &size))
> +		goto out;
> +
>  	if (size == 0 || size > 65536 || size > ELF_MIN_ALIGN)
>  		goto out;
>  
> -- 
> 2.49.0
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR