Re: [PATCH] binfmt_elf: use check_mul_overflow() for size calc

[Jan Kara <jack@suse.cz>]

On Mon 09-06-25 21:04:36, Kees Cook wrote:
> On Sat, Jun 07, 2025 at 01:58:44PM +0530, Pranav Tyagi wrote:
> > Use check_mul_overflow() to safely compute the total size of ELF program
> > headers instead of relying on direct multiplication.
> > 
> > Directly multiplying sizeof(struct elf_phdr) with e_phnum risks integer
> > overflow, especially on 32-bit systems or with malformed ELF binaries
> > crafted to trigger wrap-around. If an overflow occurs, kmalloc() could
> > allocate insufficient memory, potentially leading to out-of-bound
> > accesses, memory corruption or security vulnerabilities.
> > 
> > Using check_mul_overflow() ensures the multiplication is performed
> > safely and detects overflows before memory allocation. This change makes
> > the function more robust when handling untrusted or corrupted binaries.
> > 
> > Signed-off-by: Pranav Tyagi <pranav.tyagi03@gmail.com>
> > Link: https://github.com/KSPP/linux/issues/92
> > ---
> >  fs/binfmt_elf.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> > index a43363d593e5..774e705798b8 100644
> > --- a/fs/binfmt_elf.c
> > +++ b/fs/binfmt_elf.c
> > @@ -518,7 +518,10 @@ static struct elf_phdr *load_elf_phdrs(const struct elfhdr *elf_ex,
> >  
> >  	/* Sanity check the number of program headers... */
> >  	/* ...and their total size. */
> > -	size = sizeof(struct elf_phdr) * elf_ex->e_phnum;
> 
> size is unsigned int, which has a maximum value of 4,294,967,295.
> 
> elf_ex->e_phnum is a u16 (2 bytes) and will not be changing:
> 
> $ pahole -C elf64_hdr */fs/binfmt_elf.o
> struct elf64_hdr {
> 	...
>         Elf64_Half                 e_phnum;              /*    56     2 */
> 	...

Ah, what confused me was that I somehow thought Elf64_Half is u32 without
checking it's definition which clearly shows its actually u16. Thanks for
checking it! You're right that the patch is pointless then.

								Honza
-- 
Jan Kara <jack@suse.com>
SUSE Labs, CR