Re: [PATCH] block: partitions: reject GPT entries with starting_lba > ending_lba

[Christoph Hellwig <hch@lst.de>]

On Mon, Nov 02, 2026 at 04:04:42PM +0800, Zizhi Wo wrote:
> From: Zizhi Wo <wozizhi@huawei.com>
> 
> A GPT entry whose starting_lba is greater than its ending_lba is accepted,
> and the kernel creates a partition with a bogus size. The bogus sector
> count defeats the end-of-device check, so I/O through that partition is not
> confined to it and can access sectors outside the partition on the same
> disk.
> 
> is_pte_valid() only rejects an entry when its type is NULL or when
> starting_lba or ending_lba is greater than lastlba; it never checks that
> starting_lba <= ending_lba. For a reversed entry both field checks still
> pass, but efi_partition() computes size = ending_lba - starting_lba + 1 in
> u64, which underflows to a huge value. That value also wraps in the
> end-of-device check in blk_add_partition() (from + size) and does not fit
> the signed i_size, which turns negative.
> 
> Reject entries with starting_lba > ending_lba in is_pte_valid(), matching
> the head-level check against last_usable_lba < first_usable_lba.

Looks good in general.  But should this be a >= to also catch zero-sized
entries?