efi_partition_mkpart() validated the requested partition range against hardcoded device geometry: start_lba against a fixed 34 and end_lba against last_lba(blk) - 33. These offsets assume the default layout of 128 partition entries (32 sectors) plus the backup GPT header.
The authoritative bounds are first_usable_lba and last_usable_lba stored in the GPT header being modified. They can differ from the hardcoded values, e.g. when a table is read from disk that was created for a smaller device (last_usable_lba retains the smaller value until the GPT is rewritten) or that reserves a differently sized partition entry array. In those cases the old check allowed a partition to extend past last_usable_lba, overlapping the reserved backup entry array and GPT header. Check start_lba/end_lba against the header's first_usable_lba and last_usable_lba instead. Signed-off-by: Sascha Hauer <[email protected]> --- common/partitions/efi.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/common/partitions/efi.c b/common/partitions/efi.c index 98172672ff..59b9fa9b55 100644 --- a/common/partitions/efi.c +++ b/common/partitions/efi.c @@ -764,15 +764,18 @@ static __maybe_unused int efi_partition_mkpart(struct partition_desc *pd, gpt_entry *pte; int i; const guid_t *guid; + uint64_t first_usable_lba = le64_to_cpu(gpt->first_usable_lba); + uint64_t last_usable_lba = le64_to_cpu(gpt->last_usable_lba); - if (start_lba < 34) { - pr_err("invalid start LBA %lld, minimum is 34\n", start_lba); + if (start_lba < first_usable_lba) { + pr_err("invalid start LBA %lld, minimum is %lld\n", start_lba, + first_usable_lba); return -EINVAL; } - if (end_lba >= last_lba(pd->blk) - 33) { + if (end_lba > last_usable_lba) { pr_err("invalid end LBA %lld, maximum is %lld\n", end_lba, - last_lba(pd->blk) - 34); + last_usable_lba); return -EINVAL; } -- 2.47.3
