[PATCH 1/4] efi: loader: fix integer overflow in PE virt_size calculation

[Sascha Hauer <s.hauer@pengutronix.de>]

From: Sascha Hauer <sascha@saschahauer.de>

sec->VirtualAddress and section_size() are both u32. Their addition can
wrap on overflow before being widened to unsigned long by max_t. For
example VirtualAddress=0xFFFF0000 + VirtualSize=0x20000 wraps to
0x10000, producing an undersized allocation. The subsequent memset and
memcpy to efi_reloc + sec->VirtualAddress then write far past the
allocated buffer.

On ARM32 (which selects HAVE_EFI_LOADER), unsigned long is also 32 bits,
so a section layout that overflows u32 cannot be mapped in the address
space at all. Use check_add_overflow() to detect the wraparound and
reject the PE image as corrupt.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 efi/loader/pe.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/efi/loader/pe.c b/efi/loader/pe.c
index 3c30211f10..7c5aaa1f91 100644
--- a/efi/loader/pe.c
+++ b/efi/loader/pe.c
@@ -23,6 +23,7 @@
 #include <pe.h>
 #include <qsort.h>
 #include <linux/err.h>
+#include <linux/overflow.h>
 
 static int machines[] = {
 #if defined(__aarch64__)
@@ -636,9 +637,15 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
 	/* Calculate upper virtual address boundary */
 	for (i = num_sections - 1; i >= 0; i--) {
 		IMAGE_SECTION_HEADER *sec = &sections[i];
+		unsigned long vs;
 
-		virt_size = max_t(unsigned long, virt_size,
-				  sec->VirtualAddress + section_size(sec));
+		if (check_add_overflow((unsigned long)sec->VirtualAddress,
+				       (unsigned long)section_size(sec), &vs)) {
+			pr_err("Section %d virtual address overflow\n", i);
+			return EFI_LOAD_ERROR;
+		}
+
+		virt_size = max(virt_size, vs);
 	}
 
 	/* Read 32/64bit specific header bits */
-- 
2.47.3