Re: [PATCH v2] partitions: aix: bound the lvd scan to one sector

[Philippe De Muyter <phdm@macqel.be>]

On Tue, Jul 14, 2026 at 07:48:06AM -0400, Michael Bommarito wrote:
> aix_partition() reads the logical-volume descriptor array as a single
> sector and then scans it:
> 
> ...
> 
> Bound the scan to the number of struct lvd entries that fit in the
> sector that was actually read.
> 
> ...
> 
> diff --git a/block/partitions/aix.c b/block/partitions/aix.c
> index f3c4174e003e9..689837deba279 100644
> --- a/block/partitions/aix.c
> +++ b/block/partitions/aix.c
> @@ -208,7 +208,14 @@ int aix_partition(struct parsed_partitions *state)
>  		if (n) {
>  			int foundlvs = 0;
>  
> -			for (i = 0; foundlvs < numlvs && i < state->limit; i += 1) {
> +			/*
> +			 * The lvd array was read as a single sector; only the
> +			 * struct lvd entries that fit in it are valid.  Bound the
> +			 * scan so an on-disk numlvs larger than that cannot walk

I'd prefer the comment not to need wrapping at 80 columns, even in a patch ...
> +			 * the read buffer out of bounds.
> +			 */
> +			for (i = 0; foundlvs < numlvs && i < state->limit &&
> +				    i < SECTOR_SIZE / (int)sizeof(struct lvd); i++) {
>  				lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps);
>  				if (lvip[i].pps_per_lv)
>  					foundlvs += 1;
> -- 
> 2.53.0

but nevertheless

Reviewed-by: Philippe De Muyter <phdm@macqel.be>

Thanks

Philippe