github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bootconfig fixes for v7.3-rc3

Browse Source 
- bootconfig: Fix integer overflow and truncation vulnerabilities in size checks
   . tools/bootconfig: Fix integer overflow and truncation in size checks.
     Fix size check bypasses caused by integer overflow and truncation
     when parsing initrd or standalone bootconfig files, preventing
     buffer overflow and out-of-bounds writes in the userspace tool.
   . bootconfig: Fix integer overflow in initrd size check.
     Fix pointer arithmetic wrap-around in get_boot_config_from_initrd()
     when handling crafted huge size values, preventing fatal kernel
     page faults during early boot.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmqml0UbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bXecH/jH1wLtkeeDumrR+5OGn
 hbLnTDryprnhXBP7gKmYfcVRJzF9HZ1Ro12R8ea4N/NJieUi+EDQQ/yn6TdIpV3z
 AU4In+zKT/q2hF3R1rmYuYxEMo9Po+dxgoB3BxKdwh9aDz8kPxQGP2/0Q/vjVMvZ
 5YosoEGYtNW6NpovVK+nMkYY0TwGXtft3tdGvbdMFToGf73EgeDA7POgdCXYgiP2
 D6equcjf7mRyBxzApCXzEEBynmHI6JTbZ6w0HGWN2bU9iwk/a/jiSBGGFrWopar6
 YhQdySy7mmyHZaQUOiz6M6kYvmF0PaLsiA0NMmZ6B3uKPv+wc7OShSoiknGRgBJc
 Vc4=
 =TCCT
 -----END PGP SIGNATURE-----

Merge tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull bootconfig fixes from Masami Hiramatsu:
 "Fix integer overflow and truncation in size checks.

   - Fix size check bypasses caused by integer overflow and truncation
     when parsing initrd or standalone bootconfig files, preventing
     buffer overflow and out-of-bounds writes in the userspace tool.

   - Fix pointer arithmetic wrap-around in get_boot_config_from_initrd()
     when handling crafted huge size values, preventing fatal kernel
     page faults during early boot"

* tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  bootconfig: Fix integer overflow in initrd size check
  tools/bootconfig: Fix integer overflow and truncation in size checks
This commit is contained in:
Linus Torvalds 2026-09-13 09:16:36 -07:00
commit 6a0b3fb48d
2 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
init/main.c
View File

@ -277,7 +277,8 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
u8 *hdr;
int i;
if (!initrd_end)
if (!initrd_end || initrd_end < initrd_start ||
initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
return NULL;
data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
@ -294,16 +295,26 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
found:
hdr = (u8 *)(data - 8);
if ((unsigned long)hdr < initrd_start)
return NULL;
size = get_unaligned_le32(hdr);
csum = get_unaligned_le32(hdr + 4);
data = ((void *)hdr) - size;
if ((unsigned long)data < initrd_start) {
pr_err("bootconfig size %d is greater than initrd size %ld\n",
if (size > XBC_DATA_MAX) {
pr_err("bootconfig size %u is greater than max size %d\n",
size, XBC_DATA_MAX);
return NULL;
}
if (size > ((unsigned long)hdr - initrd_start)) {
pr_err("bootconfig size %u is greater than initrd size %lu\n",
size, initrd_end - initrd_start);
return NULL;
}
data = ((void *)hdr) - size;
if (xbc_calc_checksum(data, size) != csum) {
pr_err("bootconfig checksum failed\n");
return NULL;
@ -394,12 +405,6 @@ static void __init setup_boot_config(void)
return;
}
if (size >= XBC_DATA_MAX) {
pr_err("bootconfig size %ld greater than max size %d\n",
(long)size, XBC_DATA_MAX);
return;
}
ret = xbc_init(data, size, &msg, &pos);
if (ret < 0) {
if (pos < 0)

13
tools/bootconfig/main.c
View File

@ -140,6 +140,9 @@ static int load_xbc_fd(int fd, char **buf, int size)
{
int ret;
if (size < 0 || size > XBC_DATA_MAX)
return -EINVAL;
*buf = malloc(size + 1);
if (!*buf)
return -ENOMEM;
@ -168,6 +171,13 @@ static int load_xbc_file(const char *path, char **buf)
return ret;
}
if (stat.st_size > XBC_DATA_MAX) {
pr_err("%s size is too big\n", path);
ret = -E2BIG;
close(fd);
return ret;
}
ret = load_xbc_fd(fd, buf, stat.st_size);
close(fd);
@ -218,7 +228,8 @@ static int load_xbc_from_initrd(int fd, char **buf)
csum = le32toh(csum);
/* Wrong size error */
if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
if (size > XBC_DATA_MAX ||
size > stat.st_size - BOOTCONFIG_FOOTER_SIZE) {
pr_err("bootconfig size is too big\n");
return -E2BIG;
}