[PATCH] mtd: parsers: redboot: reject unterminated FIS names

[PATCH] mtd: parsers: redboot: reject unterminated FIS names

[Pengpeng Hou]

RedBoot FIS partition names are stored in a fixed 16-byte field that is
expected to be NUL-terminated. parse_redboot_partitions() used strlen()
to size the names area and later copied the same field with strcpy(), so
a malformed table entry without a terminator could make both operations
read beyond the descriptor.

Validate each accepted FIS name with strnlen() before adding it to the
partition list.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/mtd/parsers/redboot.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c
index bf162c44..120b2eab 100644
--- a/drivers/mtd/parsers/redboot.c
+++ b/drivers/mtd/parsers/redboot.c
@@ -192,6 +192,7 @@ nogood:
 
 	for (i = 0; i < numslots; i++) {
 		struct fis_list *new_fl, **prev;
+		size_t name_len;
 
 		if (buf[i].name[0] == 0xff) {
 			if (buf[i].name[1] == 0xff) {
@@ -203,8 +204,14 @@ nogood:
 		if (!redboot_checksum(&buf[i]))
 			break;
 
+		name_len = strnlen(buf[i].name, sizeof(buf[i].name));
+		if (name_len == sizeof(buf[i].name)) {
+			ret = -EINVAL;
+			goto out;
+		}
+
 		new_fl = kmalloc_obj(struct fis_list);
-		namelen += strlen(buf[i].name) + 1;
+		namelen += name_len + 1;
 		if (!new_fl) {
 			ret = -ENOMEM;
 			goto out;

Re: [PATCH] mtd: parsers: redboot: reject unterminated FIS names

[Miquel Raynal]

Hi Pengpeng,

On 01/07/2026 at 13:39:09 +08, Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:

> RedBoot FIS partition names are stored in a fixed 16-byte field that is
> expected to be NUL-terminated. parse_redboot_partitions() used strlen()
> to size the names area and later copied the same field with strcpy(), so
> a malformed table entry without a terminator could make both operations
> read beyond the descriptor.
>
> Validate each accepted FIS name with strnlen() before adding it to the
> partition list.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Please add Fixes and Cc stable tags whenever you send a fix. The fixes
look correct and are correctly documented, but all of them miss
the tags.

Thanks,
Miquèl

Re: [PATCH] mtd: parsers: redboot: reject unterminated FIS names

[Miquel Raynal]

On Wed, 01 Jul 2026 13:39:09 +0800, Pengpeng Hou wrote:
> RedBoot FIS partition names are stored in a fixed 16-byte field that is
> expected to be NUL-terminated. parse_redboot_partitions() used strlen()
> to size the names area and later copied the same field with strcpy(), so
> a malformed table entry without a terminator could make both operations
> read beyond the descriptor.
> 
> Validate each accepted FIS name with strnlen() before adding it to the
> partition list.
> 
> [...]

Applied to nand/next, thanks!

[1/1] mtd: parsers: redboot: reject unterminated FIS names
      commit: adfc275b317c02cd043b0cf28b8cfb7459b041f0

Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).

Kind regards,
Miquèl