[PATCH] mtd: mtdpart: validate partition bounds in mtd_add_partition()

[PATCH] mtd: mtdpart: validate partition bounds in mtd_add_partition()

[Deepanshu Kartikey]

mtd_add_partition() checks that 'length' is positive but does not
validate that 'offset + length' fits within the parent partition's
size. A userspace caller using the BLKPG_ADD_PARTITION ioctl can
supply a crafted large 'length' value that passes the length <= 0
check, causing add_mtd_device() to fire a WARN_ON() when it detects
the oversized partition.

Fix this by adding explicit bounds checks before allocate_partition()
is called:
  - Reject negative or out-of-range offsets.
  - Use u64 arithmetic to safely check offset + length <= parent_size,
    avoiding potential signed integer overflow.

Reported-by: syzbot+3ae80219c633aca5431c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/mtd/mtdpart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 795a94e6b482..1a0e2207e440 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -264,6 +264,11 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
 	if (length <= 0)
 		return -EINVAL;
 
+	if (offset < 0 || offset >= (long long)parent_size)
+		return -EINVAL;
+
+	if ((u64)offset + (u64)length > parent_size)
+		return -EINVAL;
 	memset(&part, 0, sizeof(part));
 	part.name = name;
 	part.size = length;
-- 
2.43.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [PATCH] mtd: mtdpart: validate partition bounds in mtd_add_partition()

[Miquel Raynal]

On Sun, 21 Jun 2026 04:26:25 +0530, Deepanshu Kartikey wrote:
> mtd_add_partition() checks that 'length' is positive but does not
> validate that 'offset + length' fits within the parent partition's
> size. A userspace caller using the BLKPG_ADD_PARTITION ioctl can
> supply a crafted large 'length' value that passes the length <= 0
> check, causing add_mtd_device() to fire a WARN_ON() when it detects
> the oversized partition.
> 
> [...]

Applied to mtd/fixes, thanks!

[1/1] mtd: mtdpart: validate partition bounds in mtd_add_partition()
      commit: a74e31d0a2d52c65d9a6647c87b54bf78c0d9317

Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).

Kind regards,
Miquèl


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/