[PATCH 1/4] efi: loader: fix integer overflow in PE virt_size calculation

Sascha Hauer
2026-04-13T12:37:21Z

From: Sascha Hauer <sascha@saschahauer.de>

sec->VirtualAddress and section_size() are both u32. Their addition can
wrap on overflow before being widened to unsigned long by max_t. For
example VirtualAddress=0xFFFF0000 + VirtualSize=0x20000 wraps to
0x10000, producing an undersized allocation. The subsequent memset and
memcpy to efi_reloc + sec->VirtualAddress then write far past the
allocated buffer.

On ARM32 (which selects HAVE_EFI_LOADER), unsigned long is also 32 bits,
so a section layout that overflows u32 cannot be mapped in the address
space at all. Use check_add_overflow() to detect the wraparound and
reject the PE image as corrupt.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
efi/loader/pe.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/efi/loader/pe.c b/efi/loader/pe.c
index 3c30211f10..7c5aaa1f91 100644
--- a/efi/loader/pe.c
+++ b/efi/loader/pe.c
@@ -23,6 +23,7 @@
#include <pe.h>
#include <qsort.h>
#include <linux/err.h>
+#include <linux/overflow.h>

static int machines[] = {
#if defined(__aarch64__)
@@ -636,9 +637,15 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj *handle,
/* Calculate upper virtual address boundary */
for (i = num_sections - 1; i >= 0; i--) {
IMAGE_SECTION_HEADER *sec = &sections[i];
+ unsigned long vs;

- virt_size = max_t(unsigned long, virt_size,
- sec->VirtualAddress + section_size(sec));
+ if (check_add_overflow((unsigned long)sec->VirtualAddress,
+ (unsigned long)section_size(sec), &vs)) {
+ pr_err("Section %d virtual address overflow\n", i);
+ return EFI_LOAD_ERROR;
+ }
+
+ virt_size = max(virt_size, vs);
}

/* Read 32/64bit specific header bits */
--
2.47.3