Re: [PATCH 1/2] ubi: fastmap: Check the PEB numbers in the fastmap lists

[Zhihao Cheng <chengzhihao1@huawei.com>]

在 2026/10/24 20:43, Alejandro Pacheco 写道:
> From: Alejandro Pacheco <ale@alepacheco.dev>
> 
> ubi_attach_fastmap() reads the free, used, scrub and erase lists of the
> fastmap and adds every PEB number in them to the attach information as
> it is on the media. ubi_wl_init() later uses these PEB numbers as
> indexes into ubi->lookuptbl, which has ubi->peb_count entries, and the
> PEBs of the used and scrub lists become the PEBs of the volumes' LEBs.
> None of them is checked against the device, so a fastmap listing a PEB
> number that is negative or not below ubi->peb_count makes ubi_wl_init()
> write outside ubi->lookuptbl.
> 
> The PEB numbers of the two pools are not affected: scan_pool() reads
> every pool PEB from the flash before using it, and the MTD layer refuses
> an offset outside the device. A PEB number of an EBA table is only
> accepted when it is found in the used list.
> 
> Check every PEB number of the four lists against ubi->peb_count, next to
> the other sanity checks of the fastmap, and treat a fastmap with a bad
> one as unusable, so that UBI attaches by scanning instead. Fastmaps
> written by UBI are not affected: ubi_write_fastmap() only lists PEBs of
> the device.
> 
> This needs a crafted fastmap (its data CRC catches random corruption)
> on a device that UBI attaches at boot or that a user with
> CAP_SYS_RESOURCE attaches.
> 
> An LLM coding assistant was used to find this bug and to write this
> patch and its changelog.
> 
> Fixes: dbb7d2a88d2a ("UBI: Add fastmap core")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alejandro Pacheco <ale@alepacheco.dev>
> ---
>   drivers/mtd/ubi/fastmap.c | 40 +++++++++++++++++++++++++++++----------
>   1 file changed, 30 insertions(+), 10 deletions(-)
> 

Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
> diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
> index 3f9fb7c181f..41ead6b4f0a 100644
> --- a/drivers/mtd/ubi/fastmap.c
> +++ b/drivers/mtd/ubi/fastmap.c
> @@ -558,7 +558,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
>   	struct ubi_fm_ec *fmec;
>   	struct ubi_fm_volhdr *fmvhdr;
>   	struct ubi_fm_eba *fm_eba;
> -	int ret, i, j, pool_size, wl_pool_size;
> +	int ret, i, j, pnum, pool_size, wl_pool_size;
>   	size_t fm_pos = 0, fm_size = ubi->fm_size;
>   	unsigned long long max_sqnum = 0;
>   	void *fm_raw = ubi->fm_buf;
> @@ -640,8 +640,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
>   		if (fm_pos >= fm_size)
>   			goto fail_bad;
>   
> -		ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),
> -			      be32_to_cpu(fmec->ec), 0);
> +		pnum = be32_to_cpu(fmec->pnum);
> +		if (pnum < 0 || pnum >= ubi->peb_count) {
> +			ubi_err(ubi, "bad PEB %i in fastmap free list", pnum);
> +			goto fail_bad;
> +		}
> +
> +		ret = add_aeb(ai, &ai->free, pnum, be32_to_cpu(fmec->ec), 0);
>   		if (ret)
>   			goto fail;
>   	}
> @@ -653,8 +658,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
>   		if (fm_pos >= fm_size)
>   			goto fail_bad;
>   
> -		ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
> -			      be32_to_cpu(fmec->ec), 0);
> +		pnum = be32_to_cpu(fmec->pnum);
> +		if (pnum < 0 || pnum >= ubi->peb_count) {
> +			ubi_err(ubi, "bad PEB %i in fastmap used list", pnum);
> +			goto fail_bad;
> +		}
> +
> +		ret = add_aeb(ai, &used, pnum, be32_to_cpu(fmec->ec), 0);
>   		if (ret)
>   			goto fail;
>   	}
> @@ -666,8 +676,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
>   		if (fm_pos >= fm_size)
>   			goto fail_bad;
>   
> -		ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
> -			      be32_to_cpu(fmec->ec), 1);
> +		pnum = be32_to_cpu(fmec->pnum);
> +		if (pnum < 0 || pnum >= ubi->peb_count) {
> +			ubi_err(ubi, "bad PEB %i in fastmap scrub list", pnum);
> +			goto fail_bad;
> +		}
> +
> +		ret = add_aeb(ai, &used, pnum, be32_to_cpu(fmec->ec), 1);
>   		if (ret)
>   			goto fail;
>   	}
> @@ -679,8 +694,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
>   		if (fm_pos >= fm_size)
>   			goto fail_bad;
>   
> -		ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),
> -			      be32_to_cpu(fmec->ec), 1);
> +		pnum = be32_to_cpu(fmec->pnum);
> +		if (pnum < 0 || pnum >= ubi->peb_count) {
> +			ubi_err(ubi, "bad PEB %i in fastmap erase list", pnum);
> +			goto fail_bad;
> +		}
> +
> +		ret = add_aeb(ai, &ai->erase, pnum, be32_to_cpu(fmec->ec), 1);
>   		if (ret)
>   			goto fail;
>   	}
> @@ -732,7 +752,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
>   		}
>   
>   		for (j = 0; j < be32_to_cpu(fm_eba->reserved_pebs); j++) {
> -			int pnum = be32_to_cpu(fm_eba->pnum[j]);
> +			pnum = be32_to_cpu(fm_eba->pnum[j]);
>   
>   			if (pnum < 0)
>   				continue;
> 
> ______________________________________________________
> Linux MTD discussion mailing list
> http://lists.infradead.org/mailman/listinfo/linux-mtd/
> .
>