[PATCH 0/2] ubi: Check two values read from the media at attach time

["Alejandro Pacheco" <ale@alepacheco.dev>]

Two values that UBI reads from the media when it attaches a device are
used as an index and as a length without being checked against the
device or the volume:

 - the PEB numbers of the free, used, scrub and erase lists of a
   fastmap, which ubi_wl_init() uses to index ubi->lookuptbl;

 - the data size of the last LEB of a static volume, which
   ubi_check_volume() reads into a buffer of vol->usable_leb_size bytes
   when the volume is first opened.

Patch 1 rejects a fastmap with an out-of-range PEB number, so that UBI
attaches by scanning instead; patch 2 makes check_av() reject a static
volume whose last LEB data size does not fit its usable LEB size. Both
need a crafted image: the fastmap and the VID headers carry CRCs.

Testing: UML (ARCH=um) with KASAN and KASAN_VMALLOC, a 64 MiB mtdram
device with 128 KiB eraseblocks, fastmap on, this base with and without
the series. Each boot formats the device, makes a dynamic volume and two
static volumes (the last LEB partly used and exactly full), writes them,
detaches, attaches from the fastmap UBI wrote and reads every volume
back; that passes with and without the series. It then attaches once
more with one value of the fastmap altered:

 - the first PEB number of the free list set to the PEB count (512):
   without the series KASAN reports a slab-out-of-bounds write in
   ubi_wl_init(); with it UBI logs "bad PEB 512 in fastmap free list",
   attaches by scanning, and the volumes read back;

 - the last LEB data size of the static volumes set to the LEB size
   + 1024: without the series the first read of the static volume
   fails the UBI assertions in ubi_eba_read_leb() and ubi_io_read() and
   does not return (the boot was stopped after 15 minutes); with it the
   attach fails with "bad attaching information, error 6".

The altered values were set by a test-only change in
ubi_attach_fastmap(), right after it reads them from the fastmap, not by
a crafted image. Not tested: the used, scrub and erase lists, negative
values, patch 2 on the scan path, and 32-bit kernels. W=1 builds of
drivers/mtd/ubi/ (x86_64) show no warnings with or without the series.

Alejandro Pacheco (2):
  ubi: fastmap: Check the PEB numbers in the fastmap lists
  ubi: Check the data size of the last LEB of static volumes

 drivers/mtd/ubi/fastmap.c | 40 +++++++++++++++++++++++++++++----------
 drivers/mtd/ubi/vtbl.c    |  6 ++++++
 2 files changed, 36 insertions(+), 10 deletions(-)


base-commit: 734bef548a96e8774d6eef5dfa2026c6edc4e80b