Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:09:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Browse Source 
Pull bootconfig fixes from Masami Hiramatsu:
 "Fix integer overflow and truncation in size checks.

   - Fix size check bypasses caused by integer overflow and truncation
     when parsing initrd or standalone bootconfig files, preventing
     buffer overflow and out-of-bounds writes in the userspace tool.

   - Fix pointer arithmetic wrap-around in get_boot_config_from_initrd()
     when handling crafted huge size values, preventing fatal kernel
     page faults during early boot"

* tag 'bootconfig-fixes-v7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  bootconfig: Fix integer overflow in initrd size check
  tools/bootconfig: Fix integer overflow and truncation in size checks
This commit is contained in:
Linus Torvalds
2026-09-13 09:16:36 -07:00
parent c874ace034 7812d6dab0
commit 6a0b3fb48d
2 changed files with 27 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/bootconfig/main.c
+12 -1
View File
@@ -140,6 +140,9 @@ static int load_xbc_fd(int fd, char **buf, int size)
{
int ret;
if (size < 0 || size > XBC_DATA_MAX)
return -EINVAL;
*buf = malloc(size + 1);
if (!*buf)
return -ENOMEM;
@@ -168,6 +171,13 @@ static int load_xbc_file(const char *path, char **buf)
return ret;
}
if (stat.st_size > XBC_DATA_MAX) {
pr_err("%s size is too big\n", path);
ret = -E2BIG;
close(fd);
return ret;
}
ret = load_xbc_fd(fd, buf, stat.st_size);
close(fd);
@@ -218,7 +228,8 @@ static int load_xbc_from_initrd(int fd, char **buf)
csum = le32toh(csum);
/* Wrong size error */
if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
if (size > XBC_DATA_MAX ||
size > stat.st_size - BOOTCONFIG_FOOTER_SIZE) {
pr_err("bootconfig size is too big\n");
return -E2BIG;
}