Re: [PATCH 1/4] efi: loader: fix integer overflow in PE virt_size calculation

Ahmad Fatoum
2026-04-14T08:42:17Z

On 4/13/26 2:36 PM, Sascha Hauer wrote:
> From: Sascha Hauer <sascha@saschahauer.de>
>
> sec->VirtualAddress and section_size() are both u32. Their addition can
> wrap on overflow before being widened to unsigned long by max_t. For
> example VirtualAddress=0xFFFF0000 + VirtualSize=0x20000 wraps to
> 0x10000, producing an undersized allocation. The subsequent memset and
> memcpy to efi_reloc + sec->VirtualAddress then write far past the
> allocated buffer.
>
> On ARM32 (which selects HAVE_EFI_LOADER), unsigned long is also 32 bits,
> so a section layout that overflows u32 cannot be mapped in the address
> space at all. Use check_add_overflow() to detect the wraparound and
> reject the PE image as corrupt.
>
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
>
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

> ---
> efi/loader/pe.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/efi/loader/pe.c b/efi/loader/pe.c
> index 3c30211f10..7c5aaa1f91 100644
> --- a/efi/loader/pe.c
> +++ b/efi/loader/pe.c
> @@ -23,6 +23,7 @@
> #include <pe.h>
> #include <qsort.h>
> #include <linux/err.h>
> +#include <linux/overflow.h>
>
> static int machines[] = {
> #if defined(__aarch64__)
> @@ -636,9 +637,15 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
> /* Calculate upper virtual address boundary */
> for (i = num_sections - 1; i >= 0; i--) {
> IMAGE_SECTION_HEADER *sec = &sections[i];
> + unsigned long vs;
>
> - virt_size = max_t(unsigned long, virt_size,
> - sec->VirtualAddress + section_size(sec));
> + if (check_add_overflow((unsigned long)sec->VirtualAddress,
> + (unsigned long)section_size(sec), &vs)) {
> + pr_err("Section %d virtual address overflow\n", i);
> + return EFI_LOAD_ERROR;
> + }
> +
> + virt_size = max(virt_size, vs);
> }
>
> /* Read 32/64bit specific header bits */

--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |