[PATCH v4 0/2] bootconfig: Fix integer overflow problems

[PATCH v4 0/2] bootconfig: Fix integer overflow problems

[Masami Hiramatsu (Google)]

Hi,

Here are v4 patches to fix bootconfig size overflow issue. If there is a wrong
bootconfig size is recorded, it can bypass the size check in the tool and the
kernel.

Here is the previous version.

  https://lore.kernel.org/all/178900555453.200943.4719889510443114485.stgit@devnote2/

This version removes redundant and wrong size check in setup_boot_config()
and add correct error message for size > XBC_DATA_MAX.

Thank you,

---

Masami Hiramatsu (Google) (2):
      tools/bootconfig: Fix integer overflow and truncation in size checks
      bootconfig: Fix integer overflow in initrd size check


 init/main.c             |   25 +++++++++++++++----------
 tools/bootconfig/main.c |   13 ++++++++++++-
 2 files changed, 27 insertions(+), 11 deletions(-)

--
Masami Hiramatsu (Google) <mhiramat@kernel.org>

[PATCH v4 1/2] tools/bootconfig: Fix integer overflow and truncation in size checks

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Sashiko reported that on 32-bit systems, if an attacker crafts size in
the bootconfig footer such that adding BOOTCONFIG_FOOTER_SIZE wraps around
(for instance, if size is 0xFFFFFFFF), the size check in
load_xbc_from_initrd() can be bypassed:

    if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
        pr_err("bootconfig size is too big\n");
        return -E2BIG;
    }

Furthermore, on 64-bit systems with an initrd > 4.29 GB, comparing a
corrupted 32-bit size (e.g. 0xFFFFFFFF) against
stat.st_size - BOOTCONFIG_FOOTER_SIZE can also bypass the check if
size is not bounded. Similarly, load_xbc_file() passes 64-bit stat.st_size
directly into the 32-bit int size parameter of load_xbc_fd(), truncating
large standalone files (>= 2GB).

In both cases, passing 0xFFFFFFFF to load_xbc_fd() truncates to -1,
resulting in malloc(0), an integer overflow in read(), and an
out-of-bounds null-byte write.

Fix this by:
1. Rejecting size > XBC_DATA_MAX or
   size > stat.st_size - BOOTCONFIG_FOOTER_SIZE in load_xbc_from_initrd().
2. Rejecting stat.st_size > XBC_DATA_MAX in load_xbc_file() before passing
   it to load_xbc_fd().
3. Checking size < 0 || size > XBC_DATA_MAX defensively in load_xbc_fd().

Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260909161113.16C691F00A3A@smtp.kernel.org/
Closes: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.8-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
Changes in v3:
 - Reject size > XBC_DATA_MAX and
   size > stat.st_size - BOOTCONFIG_FOOTER_SIZE in load_xbc_from_initrd()
   to prevent bypass on initrd > 4.29 GB.
 - Check stat.st_size > XBC_DATA_MAX in load_xbc_file() to prevent
   truncation on large standalone files.
 - Check size < 0 || size > XBC_DATA_MAX defensively in load_xbc_fd().
Changes in v2:
  - Add Cc: stable.
  - Also reject if "size > XBC_DATA_MAX", that is obviously wrong.
---
 tools/bootconfig/main.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
index 7dc9fff9b637..17d971d47f87 100644
--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
@@ -140,6 +140,9 @@ static int load_xbc_fd(int fd, char **buf, int size)
 {
 	int ret;
 
+	if (size < 0 || size > XBC_DATA_MAX)
+		return -EINVAL;
+
 	*buf = malloc(size + 1);
 	if (!*buf)
 		return -ENOMEM;
@@ -168,6 +171,13 @@ static int load_xbc_file(const char *path, char **buf)
 		return ret;
 	}
 
+	if (stat.st_size > XBC_DATA_MAX) {
+		pr_err("%s size is too big\n", path);
+		ret = -E2BIG;
+		close(fd);
+		return ret;
+	}
+
 	ret = load_xbc_fd(fd, buf, stat.st_size);
 
 	close(fd);
@@ -218,7 +228,8 @@ static int load_xbc_from_initrd(int fd, char **buf)
 	csum = le32toh(csum);
 
 	/* Wrong size error  */
-	if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
+	if (size > XBC_DATA_MAX ||
+	    size > stat.st_size - BOOTCONFIG_FOOTER_SIZE) {
 		pr_err("bootconfig size is too big\n");
 		return -E2BIG;
 	}

[PATCH v4 2/2] bootconfig: Fix integer overflow in initrd size check

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Sashiko reported that in get_boot_config_from_initrd(), a crafted initrd
with a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer
arithmetic:

    data = ((void *)hdr) - size;

to wrap around on 32-bit systems (or when pointer subtraction overflows).
Because data wraps around, the subsequent bounds check:

    if ((unsigned long)data < initrd_start)

evaluates to false, bypassing the check. The kernel then calls
xbc_calc_checksum(data, size), which attempts to read 4GB of memory,
hitting unmapped pages and triggering a fatal kernel page fault during
early boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an
unbounded 32-bit size can similarly bypass the initrd_start check.

Fix this by:
1. Ensuring the initrd is at least large enough to contain the bootconfig
   footer and verifying hdr is within the initrd bounds.
2. Checking that size does not exceed XBC_DATA_MAX and does not exceed
   the available space between initrd_start and hdr before performing
   pointer subtraction.

Fixes: de462e5f1071 ("bootconfig: Fix to remove bootconfig data from initrd while boot")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.8-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 Changes in v4:
  - Accurate the error message for size > XBC_DATA_MAX in
    get_boot_config_from_initrd().
  - Remove redundant (and wrong) size >= XBC_DATA_MAX check from
    setup_boot_config().
---
 init/main.c |   25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/init/main.c b/init/main.c
index 2613d3f9b3ce..16749bb7a219 100644
--- a/init/main.c
+++ b/init/main.c
@@ -277,7 +277,8 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
 	u8 *hdr;
 	int i;
 
-	if (!initrd_end)
+	if (!initrd_end || initrd_end < initrd_start ||
+	    initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
 		return NULL;
 
 	data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
@@ -294,16 +295,26 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
 
 found:
 	hdr = (u8 *)(data - 8);
+	if ((unsigned long)hdr < initrd_start)
+		return NULL;
+
 	size = get_unaligned_le32(hdr);
 	csum = get_unaligned_le32(hdr + 4);
 
-	data = ((void *)hdr) - size;
-	if ((unsigned long)data < initrd_start) {
-		pr_err("bootconfig size %d is greater than initrd size %ld\n",
+	if (size > XBC_DATA_MAX) {
+		pr_err("bootconfig size %u is greater than max size %d\n",
+			size, XBC_DATA_MAX);
+		return NULL;
+	}
+
+	if (size > ((unsigned long)hdr - initrd_start)) {
+		pr_err("bootconfig size %u is greater than initrd size %lu\n",
 			size, initrd_end - initrd_start);
 		return NULL;
 	}
 
+	data = ((void *)hdr) - size;
+
 	if (xbc_calc_checksum(data, size) != csum) {
 		pr_err("bootconfig checksum failed\n");
 		return NULL;
@@ -394,12 +405,6 @@ static void __init setup_boot_config(void)
 		return;
 	}
 
-	if (size >= XBC_DATA_MAX) {
-		pr_err("bootconfig size %ld greater than max size %d\n",
-			(long)size, XBC_DATA_MAX);
-		return;
-	}
-
 	ret = xbc_init(data, size, &msg, &pos);
 	if (ret < 0) {
 		if (pos < 0)

Re: [PATCH v4 1/2] tools/bootconfig: Fix integer overflow and truncation in size checks

[Sang-Heon Jeon]

On Fri, Sep 11, 2026 at 12:15 AM Masami Hiramatsu (Google)
<mhiramat@kernel.org> wrote:
>
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
>
> Sashiko reported that on 32-bit systems, if an attacker crafts size in
> the bootconfig footer such that adding BOOTCONFIG_FOOTER_SIZE wraps around
> (for instance, if size is 0xFFFFFFFF), the size check in
> load_xbc_from_initrd() can be bypassed:
>
>     if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
>         pr_err("bootconfig size is too big\n");
>         return -E2BIG;
>     }
>
> Furthermore, on 64-bit systems with an initrd > 4.29 GB, comparing a
> corrupted 32-bit size (e.g. 0xFFFFFFFF) against
> stat.st_size - BOOTCONFIG_FOOTER_SIZE can also bypass the check if
> size is not bounded. Similarly, load_xbc_file() passes 64-bit stat.st_size
> directly into the 32-bit int size parameter of load_xbc_fd(), truncating
> large standalone files (>= 2GB).
>
> In both cases, passing 0xFFFFFFFF to load_xbc_fd() truncates to -1,
> resulting in malloc(0), an integer overflow in read(), and an
> out-of-bounds null-byte write.
>
> Fix this by:
> 1. Rejecting size > XBC_DATA_MAX or
>    size > stat.st_size - BOOTCONFIG_FOOTER_SIZE in load_xbc_from_initrd().
> 2. Rejecting stat.st_size > XBC_DATA_MAX in load_xbc_file() before passing
>    it to load_xbc_fd().
> 3. Checking size < 0 || size > XBC_DATA_MAX defensively in load_xbc_fd().
>
> Fixes: 950313ebf79c ("tools: bootconfig: Add bootconfig command")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260909161113.16C691F00A3A@smtp.kernel.org/
> Closes: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/
> Assisted-by: Antigravity:gemini-3.8-flash
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
> Changes in v3:
>  - Reject size > XBC_DATA_MAX and
>    size > stat.st_size - BOOTCONFIG_FOOTER_SIZE in load_xbc_from_initrd()
>    to prevent bypass on initrd > 4.29 GB.
>  - Check stat.st_size > XBC_DATA_MAX in load_xbc_file() to prevent
>    truncation on large standalone files.
>  - Check size < 0 || size > XBC_DATA_MAX defensively in load_xbc_fd().
> Changes in v2:
>   - Add Cc: stable.
>   - Also reject if "size > XBC_DATA_MAX", that is obviously wrong.
> ---
>  tools/bootconfig/main.c |   13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c
> index 7dc9fff9b637..17d971d47f87 100644
> --- a/tools/bootconfig/main.c
> +++ b/tools/bootconfig/main.c
> @@ -140,6 +140,9 @@ static int load_xbc_fd(int fd, char **buf, int size)
>  {
>         int ret;
>
> +       if (size < 0 || size > XBC_DATA_MAX)
> +               return -EINVAL;
> +
>         *buf = malloc(size + 1);
>         if (!*buf)
>                 return -ENOMEM;
> @@ -168,6 +171,13 @@ static int load_xbc_file(const char *path, char **buf)
>                 return ret;
>         }
>
> +       if (stat.st_size > XBC_DATA_MAX) {
> +               pr_err("%s size is too big\n", path);
> +               ret = -E2BIG;
> +               close(fd);
> +               return ret;
> +       }
> +
>         ret = load_xbc_fd(fd, buf, stat.st_size);
>
>         close(fd);
> @@ -218,7 +228,8 @@ static int load_xbc_from_initrd(int fd, char **buf)
>         csum = le32toh(csum);
>
>         /* Wrong size error  */
> -       if (stat.st_size < size + BOOTCONFIG_FOOTER_SIZE) {
> +       if (size > XBC_DATA_MAX ||
> +           size > stat.st_size - BOOTCONFIG_FOOTER_SIZE) {
>                 pr_err("bootconfig size is too big\n");
>                 return -E2BIG;
>         }
>

Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>

Re: [PATCH v4 2/2] bootconfig: Fix integer overflow in initrd size check

[Sang-Heon Jeon]

On Fri, Sep 11, 2026 at 12:15 AM Masami Hiramatsu (Google)
<mhiramat@kernel.org> wrote:
>
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
>
> Sashiko reported that in get_boot_config_from_initrd(), a crafted initrd
> with a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer
> arithmetic:
>
>     data = ((void *)hdr) - size;
>
> to wrap around on 32-bit systems (or when pointer subtraction overflows).
> Because data wraps around, the subsequent bounds check:
>
>     if ((unsigned long)data < initrd_start)
>
> evaluates to false, bypassing the check. The kernel then calls
> xbc_calc_checksum(data, size), which attempts to read 4GB of memory,
> hitting unmapped pages and triggering a fatal kernel page fault during
> early boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an
> unbounded 32-bit size can similarly bypass the initrd_start check.
>
> Fix this by:
> 1. Ensuring the initrd is at least large enough to contain the bootconfig
>    footer and verifying hdr is within the initrd bounds.
> 2. Checking that size does not exceed XBC_DATA_MAX and does not exceed
>    the available space between initrd_start and hdr before performing
>    pointer subtraction.
>
> Fixes: de462e5f1071 ("bootconfig: Fix to remove bootconfig data from initrd while boot")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/
> Assisted-by: Antigravity:gemini-3.8-flash
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
>  Changes in v4:
>   - Accurate the error message for size > XBC_DATA_MAX in
>     get_boot_config_from_initrd().
>   - Remove redundant (and wrong) size >= XBC_DATA_MAX check from
>     setup_boot_config().
> ---
>  init/main.c |   25 +++++++++++++++----------
>  1 file changed, 15 insertions(+), 10 deletions(-)
>
> diff --git a/init/main.c b/init/main.c
> index 2613d3f9b3ce..16749bb7a219 100644
> --- a/init/main.c
> +++ b/init/main.c
> @@ -277,7 +277,8 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
>         u8 *hdr;
>         int i;
>
> -       if (!initrd_end)
> +       if (!initrd_end || initrd_end < initrd_start ||
> +           initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
>                 return NULL;

(nit) how about moving BOOTCONFIG_FOOTER_SIZE from tools and using it instead?

>         data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
> @@ -294,16 +295,26 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
>
>  found:
>         hdr = (u8 *)(data - 8);
> +       if ((unsigned long)hdr < initrd_start)
> +               return NULL;
> +
>         size = get_unaligned_le32(hdr);
>         csum = get_unaligned_le32(hdr + 4);
>
> -       data = ((void *)hdr) - size;
> -       if ((unsigned long)data < initrd_start) {
> -               pr_err("bootconfig size %d is greater than initrd size %ld\n",
> +       if (size > XBC_DATA_MAX) {
> +               pr_err("bootconfig size %u is greater than max size %d\n",
> +                       size, XBC_DATA_MAX);
> +               return NULL;
> +       }
> +
> +       if (size > ((unsigned long)hdr - initrd_start)) {
> +               pr_err("bootconfig size %u is greater than initrd size %lu\n",
>                         size, initrd_end - initrd_start);
>                 return NULL;
>         }
>
> +       data = ((void *)hdr) - size;
> +
>         if (xbc_calc_checksum(data, size) != csum) {
>                 pr_err("bootconfig checksum failed\n");
>                 return NULL;
> @@ -394,12 +405,6 @@ static void __init setup_boot_config(void)
>                 return;
>         }
>
> -       if (size >= XBC_DATA_MAX) {
> -               pr_err("bootconfig size %ld greater than max size %d\n",
> -                       (long)size, XBC_DATA_MAX);
> -               return;
> -       }
> -

Nice cleanup!

>         ret = xbc_init(data, size, &msg, &pos);
>         if (ret < 0) {
>                 if (pos < 0)
>

Thanks for doing this work!

Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>

Best regards,
Sang-Heon Jeon

Re: [PATCH v4 2/2] bootconfig: Fix integer overflow in initrd size check

[Masami Hiramatsu]

On Fri, 11 Sep 2026 01:29:48 +0900
Sang-Heon Jeon <ekffu200098@gmail.com> wrote:

> On Fri, Sep 11, 2026 at 12:15 AM Masami Hiramatsu (Google)
> <mhiramat@kernel.org> wrote:
> >
> > From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> >
> > Sashiko reported that in get_boot_config_from_initrd(), a crafted initrd
> > with a huge bootconfig size (such as 0xFFFFFFFF) can cause the pointer
> > arithmetic:
> >
> >     data = ((void *)hdr) - size;
> >
> > to wrap around on 32-bit systems (or when pointer subtraction overflows).
> > Because data wraps around, the subsequent bounds check:
> >
> >     if ((unsigned long)data < initrd_start)
> >
> > evaluates to false, bypassing the check. The kernel then calls
> > xbc_calc_checksum(data, size), which attempts to read 4GB of memory,
> > hitting unmapped pages and triggering a fatal kernel page fault during
> > early boot. Furthermore, on 64-bit systems with an initrd > 4.29 GB, an
> > unbounded 32-bit size can similarly bypass the initrd_start check.
> >
> > Fix this by:
> > 1. Ensuring the initrd is at least large enough to contain the bootconfig
> >    footer and verifying hdr is within the initrd bounds.
> > 2. Checking that size does not exceed XBC_DATA_MAX and does not exceed
> >    the available space between initrd_start and hdr before performing
> >    pointer subtraction.
> >
> > Fixes: de462e5f1071 ("bootconfig: Fix to remove bootconfig data from initrd while boot")
> > Cc: stable@vger.kernel.org
> > Reported-by: Sashiko <sashiko-bot@kernel.org>
> > Closes: https://lore.kernel.org/all/20260910010137.EE0431F000FF@smtp.kernel.org/
> > Assisted-by: Antigravity:gemini-3.8-flash
> > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> > ---
> >  Changes in v4:
> >   - Accurate the error message for size > XBC_DATA_MAX in
> >     get_boot_config_from_initrd().
> >   - Remove redundant (and wrong) size >= XBC_DATA_MAX check from
> >     setup_boot_config().
> > ---
> >  init/main.c |   25 +++++++++++++++----------
> >  1 file changed, 15 insertions(+), 10 deletions(-)
> >
> > diff --git a/init/main.c b/init/main.c
> > index 2613d3f9b3ce..16749bb7a219 100644
> > --- a/init/main.c
> > +++ b/init/main.c
> > @@ -277,7 +277,8 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
> >         u8 *hdr;
> >         int i;
> >
> > -       if (!initrd_end)
> > +       if (!initrd_end || initrd_end < initrd_start ||
> > +           initrd_end - initrd_start < BOOTCONFIG_MAGIC_LEN + 8)
> >                 return NULL;
> 
> (nit) how about moving BOOTCONFIG_FOOTER_SIZE from tools and using it instead?

OK, that will be done in cleanup patch.

> 
> >         data = (char *)initrd_end - BOOTCONFIG_MAGIC_LEN;
> > @@ -294,16 +295,26 @@ static void * __init get_boot_config_from_initrd(size_t *_size)
> >
> >  found:
> >         hdr = (u8 *)(data - 8);
> > +       if ((unsigned long)hdr < initrd_start)
> > +               return NULL;
> > +
> >         size = get_unaligned_le32(hdr);
> >         csum = get_unaligned_le32(hdr + 4);
> >
> > -       data = ((void *)hdr) - size;
> > -       if ((unsigned long)data < initrd_start) {
> > -               pr_err("bootconfig size %d is greater than initrd size %ld\n",
> > +       if (size > XBC_DATA_MAX) {
> > +               pr_err("bootconfig size %u is greater than max size %d\n",
> > +                       size, XBC_DATA_MAX);
> > +               return NULL;
> > +       }
> > +
> > +       if (size > ((unsigned long)hdr - initrd_start)) {
> > +               pr_err("bootconfig size %u is greater than initrd size %lu\n",
> >                         size, initrd_end - initrd_start);
> >                 return NULL;
> >         }
> >
> > +       data = ((void *)hdr) - size;
> > +
> >         if (xbc_calc_checksum(data, size) != csum) {
> >                 pr_err("bootconfig checksum failed\n");
> >                 return NULL;
> > @@ -394,12 +405,6 @@ static void __init setup_boot_config(void)
> >                 return;
> >         }
> >
> > -       if (size >= XBC_DATA_MAX) {
> > -               pr_err("bootconfig size %ld greater than max size %d\n",
> > -                       (long)size, XBC_DATA_MAX);
> > -               return;
> > -       }
> > -
> 
> Nice cleanup!
> 
> >         ret = xbc_init(data, size, &msg, &pos);
> >         if (ret < 0) {
> >                 if (pos < 0)
> >
> 
> Thanks for doing this work!
> 
> Reviewed-by: Sang-Heon Jeon <ekffu200098@gmail.com>
> 

Thanks!


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>