Guard check in module loader against integer overflow

The check:

	if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr))

may not work if there's an overflow in the right-hand side of the condition.

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

1 files changed, 2 insertions, 1 deletions

diff --git a/kernel/module.c b/kernel/module.c
index a4e60973ca73..4edbd9c11aca 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2429,7 +2429,8 @@ static int copy_and_check(struct load_info *info,
                 goto free_hdr;
         }
 
-        if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr)) {
+        if (hdr->e_shoff >= len ||
+            hdr->e_shnum * sizeof(Elf_Shdr) > len - hdr->e_shoff) {
                 err = -ENOEXEC;
                 goto free_hdr;
         }