* [PATCH] ubifs: fix out-of-bounds write in LPT commit padding
@ 2026-03-13 22:22 Jenny Guanni Qu
2026-03-14 2:15 ` Zhihao Cheng
0 siblings, 1 reply; 3+ messages in thread
From: Jenny Guanni Qu @ 2026-03-13 22:22 UTC (permalink / raw)
To: richard, chengzhihao1; +Cc: linux-mtd, klaudia, dawid, Jenny Guanni Qu
In write_cnodes(), when writing LPT data to a LEB, the code pads the
write buffer to min_io_size alignment using:
memset(buf + offs, 0xff, alen - wlen)
where wlen = offs - from and alen = ALIGN(wlen, min_io_size). The
buffer (c->lpt_buf) is allocated with size c->leb_size. When offs is
near leb_size and from is non-zero, the alignment padding can push
the memset past the end of the buffer.
For example, with leb_size=4096, offs=4000, from=3584, min_io_size=1024:
wlen=416, alen=1024, padding=608 bytes at offset 4000
writes to offsets 4000..4607, 512 bytes past the 4096-byte buffer
Clamp the padding size to not exceed the buffer boundary in all 4
instances of this pattern.
The OOB write was confirmed with KASAN using a test module that
reproduces the arithmetic with matching buffer and alignment values.
Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
---
fs/ubifs/lpt_commit.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 07351fdce722..77a7a2cd418f 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -402,7 +402,7 @@ static int write_cnodes(struct ubifs_info *c)
wlen = offs - from;
if (wlen) {
alen = ALIGN(wlen, c->min_io_size);
- memset(buf + offs, 0xff, alen - wlen);
+ memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
err = ubifs_leb_write(c, lnum, buf + from, from,
alen);
if (err)
@@ -461,7 +461,7 @@ static int write_cnodes(struct ubifs_info *c)
if (offs + c->lsave_sz > c->leb_size) {
wlen = offs - from;
alen = ALIGN(wlen, c->min_io_size);
- memset(buf + offs, 0xff, alen - wlen);
+ memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
err = ubifs_leb_write(c, lnum, buf + from, from, alen);
if (err)
return err;
@@ -487,7 +487,7 @@ static int write_cnodes(struct ubifs_info *c)
if (offs + c->ltab_sz > c->leb_size) {
wlen = offs - from;
alen = ALIGN(wlen, c->min_io_size);
- memset(buf + offs, 0xff, alen - wlen);
+ memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
err = ubifs_leb_write(c, lnum, buf + from, from, alen);
if (err)
return err;
@@ -510,7 +510,7 @@ static int write_cnodes(struct ubifs_info *c)
/* Write remaining data in buffer */
wlen = offs - from;
alen = ALIGN(wlen, c->min_io_size);
- memset(buf + offs, 0xff, alen - wlen);
+ memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
err = ubifs_leb_write(c, lnum, buf + from, from, alen);
if (err)
return err;
--
2.34.1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] ubifs: fix out-of-bounds write in LPT commit padding
2026-03-13 22:22 [PATCH] ubifs: fix out-of-bounds write in LPT commit padding Jenny Guanni Qu
@ 2026-03-14 2:15 ` Zhihao Cheng
2026-03-14 22:33 ` Guanni Qu
0 siblings, 1 reply; 3+ messages in thread
From: Zhihao Cheng @ 2026-03-14 2:15 UTC (permalink / raw)
To: Jenny Guanni Qu, richard; +Cc: linux-mtd, klaudia, dawid
在 2026/3/14 6:22, Jenny Guanni Qu 写道:
> In write_cnodes(), when writing LPT data to a LEB, the code pads the
> write buffer to min_io_size alignment using:
>
> memset(buf + offs, 0xff, alen - wlen)
>
> where wlen = offs - from and alen = ALIGN(wlen, min_io_size). The
> buffer (c->lpt_buf) is allocated with size c->leb_size. When offs is
> near leb_size and from is non-zero, the alignment padding can push
> the memset past the end of the buffer.
>
> For example, with leb_size=4096, offs=4000, from=3584, min_io_size=1024:
> wlen=416, alen=1024, padding=608 bytes at offset 4000
> writes to offsets 4000..4607, 512 bytes past the 4096-byte buffer
Hi, Guanni
How does 'from' become '3584'(which is not aligned with min_io_size[1024])?
As far as I know, the 'from' comes from 'c->nhead_offs', which is always
aligned with min_io_size.
>
> Clamp the padding size to not exceed the buffer boundary in all 4
> instances of this pattern.
>
> The OOB write was confirmed with KASAN using a test module that
> reproduces the arithmetic with matching buffer and alignment values.
>
> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
> Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
> Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
> Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
> ---
> fs/ubifs/lpt_commit.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
> index 07351fdce722..77a7a2cd418f 100644
> --- a/fs/ubifs/lpt_commit.c
> +++ b/fs/ubifs/lpt_commit.c
> @@ -402,7 +402,7 @@ static int write_cnodes(struct ubifs_info *c)
> wlen = offs - from;
> if (wlen) {
> alen = ALIGN(wlen, c->min_io_size);
> - memset(buf + offs, 0xff, alen - wlen);
> + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> err = ubifs_leb_write(c, lnum, buf + from, from,
> alen);
> if (err)
> @@ -461,7 +461,7 @@ static int write_cnodes(struct ubifs_info *c)
> if (offs + c->lsave_sz > c->leb_size) {
> wlen = offs - from;
> alen = ALIGN(wlen, c->min_io_size);
> - memset(buf + offs, 0xff, alen - wlen);
> + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> if (err)
> return err;
> @@ -487,7 +487,7 @@ static int write_cnodes(struct ubifs_info *c)
> if (offs + c->ltab_sz > c->leb_size) {
> wlen = offs - from;
> alen = ALIGN(wlen, c->min_io_size);
> - memset(buf + offs, 0xff, alen - wlen);
> + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> if (err)
> return err;
> @@ -510,7 +510,7 @@ static int write_cnodes(struct ubifs_info *c)
> /* Write remaining data in buffer */
> wlen = offs - from;
> alen = ALIGN(wlen, c->min_io_size);
> - memset(buf + offs, 0xff, alen - wlen);
> + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> if (err)
> return err;
>
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] ubifs: fix out-of-bounds write in LPT commit padding
2026-03-14 2:15 ` Zhihao Cheng
@ 2026-03-14 22:33 ` Guanni Qu
0 siblings, 0 replies; 3+ messages in thread
From: Guanni Qu @ 2026-03-14 22:33 UTC (permalink / raw)
To: Zhihao Cheng; +Cc: richard, linux-mtd, klaudia, dawid
Hi Zhihao,
You're right. 'from' is always either 0 or c->nhead_offs, which is
ALIGN(offs, c->min_io_size) (line 524). Since leb_size is also a
multiple of min_io_size, from + alen can never exceed leb_size.
My validation used artificial values that don't occur in real
execution. I'll withdraw this patch.
Apologies for the noise.
Jenny
On Fri, Mar 13, 2026 at 7:15 PM Zhihao Cheng <chengzhihao1@huawei.com> wrote:
>
> 在 2026/3/14 6:22, Jenny Guanni Qu 写道:
> > In write_cnodes(), when writing LPT data to a LEB, the code pads the
> > write buffer to min_io_size alignment using:
> >
> > memset(buf + offs, 0xff, alen - wlen)
> >
> > where wlen = offs - from and alen = ALIGN(wlen, min_io_size). The
> > buffer (c->lpt_buf) is allocated with size c->leb_size. When offs is
> > near leb_size and from is non-zero, the alignment padding can push
> > the memset past the end of the buffer.
> >
> > For example, with leb_size=4096, offs=4000, from=3584, min_io_size=1024:
> > wlen=416, alen=1024, padding=608 bytes at offset 4000
> > writes to offsets 4000..4607, 512 bytes past the 4096-byte buffer
> Hi, Guanni
> How does 'from' become '3584'(which is not aligned with min_io_size[1024])?
> As far as I know, the 'from' comes from 'c->nhead_offs', which is always
> aligned with min_io_size.
> >
> > Clamp the padding size to not exceed the buffer boundary in all 4
> > instances of this pattern.
> >
> > The OOB write was confirmed with KASAN using a test module that
> > reproduces the arithmetic with matching buffer and alignment values.
> >
> > Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> > Reported-by: Klaudia Kloc <klaudia@vidocsecurity.com>
> > Reported-by: Dawid Moczadło <dawid@vidocsecurity.com>
> > Tested-by: Jenny Guanni Qu <qguanni@gmail.com>
> > Signed-off-by: Jenny Guanni Qu <qguanni@gmail.com>
> > ---
> > fs/ubifs/lpt_commit.c | 8 ++++----
> > 1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
> > index 07351fdce722..77a7a2cd418f 100644
> > --- a/fs/ubifs/lpt_commit.c
> > +++ b/fs/ubifs/lpt_commit.c
> > @@ -402,7 +402,7 @@ static int write_cnodes(struct ubifs_info *c)
> > wlen = offs - from;
> > if (wlen) {
> > alen = ALIGN(wlen, c->min_io_size);
> > - memset(buf + offs, 0xff, alen - wlen);
> > + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> > err = ubifs_leb_write(c, lnum, buf + from, from,
> > alen);
> > if (err)
> > @@ -461,7 +461,7 @@ static int write_cnodes(struct ubifs_info *c)
> > if (offs + c->lsave_sz > c->leb_size) {
> > wlen = offs - from;
> > alen = ALIGN(wlen, c->min_io_size);
> > - memset(buf + offs, 0xff, alen - wlen);
> > + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> > err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> > if (err)
> > return err;
> > @@ -487,7 +487,7 @@ static int write_cnodes(struct ubifs_info *c)
> > if (offs + c->ltab_sz > c->leb_size) {
> > wlen = offs - from;
> > alen = ALIGN(wlen, c->min_io_size);
> > - memset(buf + offs, 0xff, alen - wlen);
> > + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> > err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> > if (err)
> > return err;
> > @@ -510,7 +510,7 @@ static int write_cnodes(struct ubifs_info *c)
> > /* Write remaining data in buffer */
> > wlen = offs - from;
> > alen = ALIGN(wlen, c->min_io_size);
> > - memset(buf + offs, 0xff, alen - wlen);
> > + memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> > err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> > if (err)
> > return err;
> >
>
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-14 22:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-13 22:22 [PATCH] ubifs: fix out-of-bounds write in LPT commit padding Jenny Guanni Qu
2026-03-14 2:15 ` Zhihao Cheng
2026-03-14 22:33 ` Guanni Qu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox