[PATCH 2/2] ubi: Check the data size of the last LEB of static volumes

[Alejandro Pacheco]

From: Alejandro Pacheco <ale@xxxxxxxxxxxxxx>

For a static volume, init_volumes() takes the data size of its last LEB
from the attach information, av->last_data_size, as vol->last_eb_bytes.
When the volume is first opened, ubi_check_volume() reads that many
bytes of the last LEB into a buffer of vol->usable_leb_size bytes.

Nothing bounds that size by vol->usable_leb_size. When UBI attaches by
scanning, it is the data_size of the last LEB's VID header, which
validate_vid_hdr() only checks against ubi->leb_size; that is larger
than the usable LEB size of a volume with a non-zero data_pad. When UBI
attaches from a fastmap, it can be the last_eb_bytes of the volume's
fastmap header, which is not checked at all. A larger size makes
ubi_check_volume() write past the end of its buffer.

Before UBI comes up, check_attaching_info() runs check_av() on every
volume that has attach information, to check it against the volume's
record in the volume table. Also reject there a static volume whose last
LEB data size is negative or larger than vol->usable_leb_size. Images
written by UBI or ubinize are not affected: no LEB of a static volume
holds more data than its usable LEB size.

This needs a crafted image (the VID header and the fastmap carry CRCs
that catch random corruption) on a device that UBI attaches at boot or
that a user with CAP_SYS_RESOURCE attaches.

An LLM coding assistant was used to find this bug and to write this
patch and its changelog.

Fixes: 801c135ce73d ("UBI: Unsorted Block Images")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Alejandro Pacheco <ale@xxxxxxxxxxxxxx>
---
 drivers/mtd/ubi/vtbl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 06d87a3013a..f1bd6e1e488 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -696,6 +696,12 @@ static int check_av(const struct ubi_volume *vol,
 		err = 5;
 		goto bad;
 	}
+	if (vol->vol_type == UBI_STATIC_VOLUME &&
+	    (av->last_data_size < 0 ||
+	     av->last_data_size > vol->usable_leb_size)) {
+		err = 6;
+		goto bad;
+	}
 	return 0;
 
 bad: