linux-kernel - Re: [PATCH] binfmt_elf: use check_mul

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH4c4jKD1TdpyfUXxvz1F_-ONTbKC=4z2V0iH4rGCBgYv0-Kxg@mail.gmail.com>
Date: Wed, 11 Jun 2025 19:47:58 +0530
From: Pranav Tyagi <pranav.tyagi03@...il.com>
To: Jan Kara <jack@...e.cz>
Cc: Kees Cook <kees@...nel.org>, viro@...iv.linux.org.uk, brauner@...nel.org, 
	linux-fsdevel@...r.kernel.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, skhan@...uxfoundation.org, 
	linux-kernel-mentees@...ts.linux.dev
Subject: Re: [PATCH] binfmt_elf: use check_mul_overflow() for size calc

On Tue, Jun 10, 2025 at 1:29 PM Jan Kara <jack@...e.cz> wrote:
>
> On Mon 09-06-25 21:04:36, Kees Cook wrote:
> > On Sat, Jun 07, 2025 at 01:58:44PM +0530, Pranav Tyagi wrote:
> > > Use check_mul_overflow() to safely compute the total size of ELF program
> > > headers instead of relying on direct multiplication.
> > >
> > > Directly multiplying sizeof(struct elf_phdr) with e_phnum risks integer
> > > overflow, especially on 32-bit systems or with malformed ELF binaries
> > > crafted to trigger wrap-around. If an overflow occurs, kmalloc() could
> > > allocate insufficient memory, potentially leading to out-of-bound
> > > accesses, memory corruption or security vulnerabilities.
> > >
> > > Using check_mul_overflow() ensures the multiplication is performed
> > > safely and detects overflows before memory allocation. This change makes
> > > the function more robust when handling untrusted or corrupted binaries.
> > >
> > > Signed-off-by: Pranav Tyagi <pranav.tyagi03@...il.com>
> > > Link: https://github.com/KSPP/linux/issues/92
> > > ---
> > >  fs/binfmt_elf.c | 5 ++++-
> > >  1 file changed, 4 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > > index a43363d593e5..774e705798b8 100644
> > > --- a/fs/binfmt_elf.c
> > > +++ b/fs/binfmt_elf.c
> > > @@ -518,7 +518,10 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
> > >
> > >     /* Sanity check the number of program headers... */
> > >     /* ...and their total size. */
> > > -   size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
> >
> > size is unsigned int, which has a maximum value of 4,294,967,295.
> >
> > elf_ex->e_phnum is a u16 (2 bytes) and will not be changing:
> >
> > $ pahole -C elf64_hdr */fs/binfmt_elf.o
> > struct elf64_hdr {
> >       ...
> >         Elf64_Half                 e_phnum;              /*    56     2 */
> >       ...
>
> Ah, what confused me was that I somehow thought Elf64_Half is u32 without
> checking it's definition which clearly shows its actually u16. Thanks for
> checking it! You're right that the patch is pointless then.
>
>                                                                 Honza
> --
> Jan Kara <jack@...e.com>
> SUSE Labs, CR

Hi,

I understand that the patch is actually pointless. I am still
new to kernel dev and learnt a lot from your comments. I will keep
this in mind while sending patches in the future.

Regards

Pranav Tyagi