From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from fhigh-b6-smtp.messagingengine.com (fhigh-b6-smtp.messagingengine.com [202.12.124.157]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 816613F12F9 for ; Tue, 25 Aug 2026 14:05:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.157 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787666709; cv=none; b=XdlBL4IX8F/IfIFfbra5DtxDTlMx07klN8xyj2tTbcY6BDKoCjZXL7USBgVBXU6cOYv1LNb7SqNM+X1H4ZRnnkMtLQmkDGRHLOzdpYzi5ghpPFnIhyJMd5VoalZMhJKbmKmNAj7D8DnQMZCBcLUyKUjrOf8iHE0Ua4j6MXBK9CI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787666709; c=relaxed/simple; bh=oXLPTvcK626LEmo9Y6gktoVtADS+1GwMDe5qaqL1Ib4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=HvbGrGWA8PH5oiCvTTX6lgMr7IKAGKBd06C3jYRXu0vOfXSINOCzT0Hk/4hvq8XWbahLcKzUeYUP4kyJYtvbKoTXlG5mqx7u11N1Zhrac+CpNU522syzwWOWjvjVsnKoxb8pEfCZG1ERGJHsHyWDi+W2XN2RYUMGD6PFjqTmN+U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com; spf=pass smtp.mailfrom=kroah.com; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b=WZ8vCk5T; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=Fgfy/xSm; arc=none smtp.client-ip=202.12.124.157 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kroah.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kroah.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kroah.com header.i=@kroah.com header.b="WZ8vCk5T"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="Fgfy/xSm" Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.stl.internal (Postfix) with ESMTP id 7AAD77A0114; Tue, 25 Aug 2026 10:05:06 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Tue, 25 Aug 2026 10:05:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kroah.com; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm3; t=1787666706; x=1787753106; bh=ucX7NLr9HW0KkTqU7iBrbPlFt2gxW2dOPH97NEKPbKU=; b= WZ8vCk5T13W3psoAdmZXSbu81UFlG2e2JI63RWWMrmUvt5qFBQfBbV+2jZfYOTL0 SU4CXOaub5gMcxs2z4f4ip33mP0X6waclmT65h21xRbwGSeNRi6OD9bQKPEBlzeA fovrftfFucP7FS1go/MQsvfCOHDgFxDGJzsL3mCZH6NET6x1+iI0neqUTaLsRIdC k6WE5N6BrruwUn2Q0OaUNqnRhpj6SwzgUx4fyLfjOqrvyECY1QgPt0sa8BY5NkZz vZug8z/aQF3PsUPY6wMd7L1rPDp8jxGZJhhIb+728wdQq0cNIqpEX+UJHgsN3Gud 0dhd1OSI/BuCIET/CxafQg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1787666706; x= 1787753106; bh=ucX7NLr9HW0KkTqU7iBrbPlFt2gxW2dOPH97NEKPbKU=; b=F gfy/xSmyBp29hh+S4gEddNfuL/RlbA2F2s64aZJvvm5Lroq1rMjLS+xQP37bpi4e 8Tze8gyR2nGXV/Q0/ADWnOXsldvzs4R9ex2lU/XUC/o9j1ienywdySucz1Qy/Vej 4AwquHqtMm2IdDXRgf4JX0V2cjH7bsGyS9+JXUgRSwaH4SzXfbDrSp7/q+drgaue Qd3BBVr3PsZy2eEY65vBDp+CgHciFTBre1nqvxy8HDGtt+5RgG1n5JdIaJWIWjNJ poXME/tFBp8Za7RSc7NscrcQ4HCSgu03x0d69xpyofNS2eexOiQlj5mzoTMxW8iO hbxNgI0Vsmlx3ysWx0Mng== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGhrtdVch8QdM5Vdv2WRheNpHzKWyr+RhuNdGJa6+gO7LgYYke4cc27gT0LwiWtpK 2GyCJCLEA1lgo0ZCBvbOe8vKWw1OijLmnbam96gP8dIdeEIW7V2ouwMVZVhxx0pvaFQw8k 4tn6kjm2btNTOM/CiAc1LChX3TCtysPb+m0ELFcQtgF+F8orw88GgtoFOE3OMg/6qg7dZw leKkL4e6pV2w6BHZtZM3viZO8iZ+vXWZiFgj3C9XwuQbdjGgGtR5vhLwF9IPmLmdBLdVQt laZjoxgP+19P1Do8/8tXqEXHeO08ll5J1jt/UkYA33xBDdCz30SqZa8NMTIy2kpco2GKY1 nNorBJhU89LhCb7zgmRQQ9IA8nPRPECThvlcmkgCD80x9oBm8uEmujLEdXKGXRKvHsVBqH qCwvfoIf8314y+xGIF1CrcHDaOI01lfr/xWW4yZqssfxNDw21ocwYa5gX1Bkbue1lVd8/x /IpvgXcuCqcOQYOYZLknsaHhvw/K1ocUXVDIjVf0ttfY5vtlrQ+eAszHKqW397p/qmZ8DT WDDR7p6OHLYzpchrOUdsqWRIL5N/xTMBO6MmLmWNC1awdSGRhjDdhHtDNVz10yhOt1Lcih GtQg7JFAiPTvE7R4M0wgrYfw2dmc4UHy60hAwmqFxDFLGxZ12/3+jco6bE9Q X-ME-Proxy: Feedback-ID: i1d2843be:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 25 Aug 2026 10:05:04 -0400 (EDT) Message-ID: Date: Tue, 25 Aug 2026 16:05:02 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mtd: parsers: afs: add size check to v2 partition To: Miquel Raynal Cc: Richard Weinberger , Vignesh Raghavendra , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org References: <20260824-mtd_break_looper-v1-1-e46d7f02faab@kroah.com> <87cxv6gvuc.fsf@bootlin.com> Content-Language: en-US From: Griffin Kroah-Hartman In-Reply-To: <87cxv6gvuc.fsf@bootlin.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 8/25/26 3:42 PM, Miquel Raynal wrote: > Hello Griffin, > > Thanks for the patch! > > On 24/08/2026 at 15:50:27 +02, Griffin Kroah-Hartman wrote: > >> Add a size check to the loop in afs_parse_v2_partition(), avoiding >> walking out of the imginfo[] array bounds if a malicious packet fakes a > "packet" refers to network wording, whereas here, in the MTD world, we > would rather talk about a malicious image. Good to know! thanks for clarifying. >> --- >> drivers/mtd/parsers/afs.c | 12 +++++++++--- >> 1 file changed, 9 insertions(+), 3 deletions(-) >> >> diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c >> index 26116694c821..2c6f8768312c 100644 >> --- a/drivers/mtd/parsers/afs.c >> +++ b/drivers/mtd/parsers/afs.c >> @@ -287,12 +287,18 @@ static int afs_parse_v2_partition(struct mtd_info *mtd, >> block_start, block_end); >> >> for (i = 0; i < region_count; i++) { >> - u32 region_load_addr = imginfo[pad + 3 + i*4]; >> - u32 region_size = imginfo[pad + 4 + i*4]; >> - u32 region_offset = imginfo[pad + 5 + i*4]; >> + u32 region_load_addr; >> + u32 region_size; >> + u32 region_offset; >> u32 region_start; >> u32 region_end; >> >> + if (pad + 5 + i*4 >= ARRAY_SIZE(imginfo)) >> + break; >> + region_load_addr = imginfo[pad + 3 + i*4]; >> + region_size = imginfo[pad + 4 + i*4]; >> + region_offset = imginfo[pad + 5 + i*4]; >> + > Looking at the code, I see that just above the loop there is an actual > check bailing out early in case the region count is overly big. In > practice: > - pad can only be 0, 1 or 2 > - imginfo array size is 36 > > The check is: > > if (region_count > (ARRAY_SIZE(imginfo) - pad - 3) / 4) > return -EINVAL; Sorry, I was not using linux-next, so I did not see that this was already checked. Thank you for the review! Griffin