[PATCH 1/4] efi: loader: fix integer overflow in PE virt_size calculation

[Ahmad Fatoum]

On 4/13/26 2:36 PM, Sascha Hauer wrote:
> From: Sascha Hauer <sascha at saschahauer.de>
> 
> sec->VirtualAddress and section_size() are both u32. Their addition can
> wrap on overflow before being widened to unsigned long by max_t. For
> example VirtualAddress=0xFFFF0000 + VirtualSize=0x20000 wraps to
> 0x10000, producing an undersized allocation. The subsequent memset and
> memcpy to efi_reloc + sec->VirtualAddress then write far past the
> allocated buffer.
> 
> On ARM32 (which selects HAVE_EFI_LOADER), unsigned long is also 32 bits,
> so a section layout that overflows u32 cannot be mapped in the address
> space at all. Use check_add_overflow() to detect the wraparound and
> reject the PE image as corrupt.
> 
> Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
> 
> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply at anthropic.com>

Reviewed-by: Ahmad Fatoum <a.fatoum at pengutronix.de>

> ---
>  efi/loader/pe.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/efi/loader/pe.c b/efi/loader/pe.c
> index 3c30211f10..7c5aaa1f91 100644
> --- a/efi/loader/pe.c
> +++ b/efi/loader/pe.c
> @@ -23,6 +23,7 @@
>  #include <pe.h>
>  #include <qsort.h>
>  #include <linux/err.h>
> +#include <linux/overflow.h>
>  
>  static int machines[] = {
>  #if defined(__aarch64__)
> @@ -636,9 +637,15 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
>  	/* Calculate upper virtual address boundary */
>  	for (i = num_sections - 1; i >= 0; i--) {
>  		IMAGE_SECTION_HEADER *sec = &sections[i];
> +		unsigned long vs;
>  
> -		virt_size = max_t(unsigned long, virt_size,
> -				  sec->VirtualAddress + section_size(sec));
> +		if (check_add_overflow((unsigned long)sec->VirtualAddress,
> +				       (unsigned long)section_size(sec), &vs)) {
> +			pr_err("Section %d virtual address overflow\n", i);
> +			return EFI_LOAD_ERROR;
> +		}
> +
> +		virt_size = max(virt_size, vs);
>  	}
>  
>  	/* Read 32/64bit specific header bits */

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |