[PATCH 1/2] ubi: fastmap: Check the PEB numbers in the fastmap lists

[Alejandro Pacheco]

From: Alejandro Pacheco <ale@xxxxxxxxxxxxxx>

ubi_attach_fastmap() reads the free, used, scrub and erase lists of the
fastmap and adds every PEB number in them to the attach information as
it is on the media. ubi_wl_init() later uses these PEB numbers as
indexes into ubi->lookuptbl, which has ubi->peb_count entries, and the
PEBs of the used and scrub lists become the PEBs of the volumes' LEBs.
None of them is checked against the device, so a fastmap listing a PEB
number that is negative or not below ubi->peb_count makes ubi_wl_init()
write outside ubi->lookuptbl.

The PEB numbers of the two pools are not affected: scan_pool() reads
every pool PEB from the flash before using it, and the MTD layer refuses
an offset outside the device. A PEB number of an EBA table is only
accepted when it is found in the used list.

Check every PEB number of the four lists against ubi->peb_count, next to
the other sanity checks of the fastmap, and treat a fastmap with a bad
one as unusable, so that UBI attaches by scanning instead. Fastmaps
written by UBI are not affected: ubi_write_fastmap() only lists PEBs of
the device.

This needs a crafted fastmap (its data CRC catches random corruption)
on a device that UBI attaches at boot or that a user with
CAP_SYS_RESOURCE attaches.

An LLM coding assistant was used to find this bug and to write this
patch and its changelog.

Fixes: dbb7d2a88d2a ("UBI: Add fastmap core")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Alejandro Pacheco <ale@xxxxxxxxxxxxxx>
---
 drivers/mtd/ubi/fastmap.c | 40 +++++++++++++++++++++++++++++----------
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
index 3f9fb7c181f..41ead6b4f0a 100644
--- a/drivers/mtd/ubi/fastmap.c
+++ b/drivers/mtd/ubi/fastmap.c
@@ -558,7 +558,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 	struct ubi_fm_ec *fmec;
 	struct ubi_fm_volhdr *fmvhdr;
 	struct ubi_fm_eba *fm_eba;
-	int ret, i, j, pool_size, wl_pool_size;
+	int ret, i, j, pnum, pool_size, wl_pool_size;
 	size_t fm_pos = 0, fm_size = ubi->fm_size;
 	unsigned long long max_sqnum = 0;
 	void *fm_raw = ubi->fm_buf;
@@ -640,8 +640,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 		if (fm_pos >= fm_size)
 			goto fail_bad;
 
-		ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum),
-			      be32_to_cpu(fmec->ec), 0);
+		pnum = be32_to_cpu(fmec->pnum);
+		if (pnum < 0 || pnum >= ubi->peb_count) {
+			ubi_err(ubi, "bad PEB %i in fastmap free list", pnum);
+			goto fail_bad;
+		}
+
+		ret = add_aeb(ai, &ai->free, pnum, be32_to_cpu(fmec->ec), 0);
 		if (ret)
 			goto fail;
 	}
@@ -653,8 +658,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 		if (fm_pos >= fm_size)
 			goto fail_bad;
 
-		ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
-			      be32_to_cpu(fmec->ec), 0);
+		pnum = be32_to_cpu(fmec->pnum);
+		if (pnum < 0 || pnum >= ubi->peb_count) {
+			ubi_err(ubi, "bad PEB %i in fastmap used list", pnum);
+			goto fail_bad;
+		}
+
+		ret = add_aeb(ai, &used, pnum, be32_to_cpu(fmec->ec), 0);
 		if (ret)
 			goto fail;
 	}
@@ -666,8 +676,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 		if (fm_pos >= fm_size)
 			goto fail_bad;
 
-		ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum),
-			      be32_to_cpu(fmec->ec), 1);
+		pnum = be32_to_cpu(fmec->pnum);
+		if (pnum < 0 || pnum >= ubi->peb_count) {
+			ubi_err(ubi, "bad PEB %i in fastmap scrub list", pnum);
+			goto fail_bad;
+		}
+
+		ret = add_aeb(ai, &used, pnum, be32_to_cpu(fmec->ec), 1);
 		if (ret)
 			goto fail;
 	}
@@ -679,8 +694,13 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 		if (fm_pos >= fm_size)
 			goto fail_bad;
 
-		ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum),
-			      be32_to_cpu(fmec->ec), 1);
+		pnum = be32_to_cpu(fmec->pnum);
+		if (pnum < 0 || pnum >= ubi->peb_count) {
+			ubi_err(ubi, "bad PEB %i in fastmap erase list", pnum);
+			goto fail_bad;
+		}
+
+		ret = add_aeb(ai, &ai->erase, pnum, be32_to_cpu(fmec->ec), 1);
 		if (ret)
 			goto fail;
 	}
@@ -732,7 +752,7 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
 		}
 
 		for (j = 0; j < be32_to_cpu(fm_eba->reserved_pebs); j++) {
-			int pnum = be32_to_cpu(fm_eba->pnum[j]);
+			pnum = be32_to_cpu(fm_eba->pnum[j]);
 
 			if (pnum < 0)
 				continue;