Re: [PATCH 2/2] ubi: Check the data size of the last LEB of static volumes

[Zhihao Cheng <chengzhihao1@huawei.com>]

在 2026/10/24 20:43, Alejandro Pacheco 写道:
> From: Alejandro Pacheco <ale@alepacheco.dev>
> 
> For a static volume, init_volumes() takes the data size of its last LEB
> from the attach information, av->last_data_size, as vol->last_eb_bytes.
> When the volume is first opened, ubi_check_volume() reads that many
> bytes of the last LEB into a buffer of vol->usable_leb_size bytes.
> 
> Nothing bounds that size by vol->usable_leb_size. When UBI attaches by
> scanning, it is the data_size of the last LEB's VID header, which
> validate_vid_hdr() only checks against ubi->leb_size; that is larger
> than the usable LEB size of a volume with a non-zero data_pad. When UBI
> attaches from a fastmap, it can be the last_eb_bytes of the volume's
> fastmap header, which is not checked at all. A larger size makes
> ubi_check_volume() write past the end of its buffer.
> 
> Before UBI comes up, check_attaching_info() runs check_av() on every
> volume that has attach information, to check it against the volume's
> record in the volume table. Also reject there a static volume whose last
> LEB data size is negative or larger than vol->usable_leb_size. Images
> written by UBI or ubinize are not affected: no LEB of a static volume
> holds more data than its usable LEB size.
> 
> This needs a crafted image (the VID header and the fastmap carry CRCs
> that catch random corruption) on a device that UBI attaches at boot or
> that a user with CAP_SYS_RESOURCE attaches.
> 
> An LLM coding assistant was used to find this bug and to write this
> patch and its changelog.
> 
> Fixes: 801c135ce73d ("UBI: Unsorted Block Images")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alejandro Pacheco <ale@alepacheco.dev>
> ---
>   drivers/mtd/ubi/vtbl.c | 6 ++++++
>   1 file changed, 6 insertions(+)

Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
> 
> diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
> index 06d87a3013a..f1bd6e1e488 100644
> --- a/drivers/mtd/ubi/vtbl.c
> +++ b/drivers/mtd/ubi/vtbl.c
> @@ -696,6 +696,12 @@ static int check_av(const struct ubi_volume *vol,
>   		err = 5;
>   		goto bad;
>   	}
> +	if (vol->vol_type == UBI_STATIC_VOLUME &&
> +	    (av->last_data_size < 0 ||
> +	     av->last_data_size > vol->usable_leb_size)) {
> +		err = 6;
> +		goto bad;
> +	}
>   	return 0;
>   
>   bad:
> .
>