On 2026-10-28T05:50:48, Ana Bobillo <[email protected]> wrote: > disk: part_efi: Check the header and entry sizes of a GPT > > validate_gpt_header() computes the CRC of a GPT header over header_size > bytes, as the header gives it, and nothing checks the size of the > partition entries before they are used: > > - the header is read into a buffer of one block, on the stack behind > part_get_info(), part_print_efi(), gpt_repair_headers() and the gpt > command, so a header_size larger than the block size makes the CRC > read past the end of that buffer > - alloc_read_gpt_entries() allocates and reads > num_partition_entries * sizeof_partition_entry bytes, computed in 32 > bits, but the entries are then used as an array of > num_partition_entries gpt_entry structures: with a smaller entry size, > or a product that wraps, part_get_gpt_pte() and part_print_efi() read > past the end of the allocation. On a 32-bit board, rounding a product > close to 4GiB up to whole blocks also wraps, to a tiny allocation that > the entries are then read into. > > As Linux does in is_gpt_valid(), refuse a header whose header_size is > smaller than the header or larger than the block it is read from, one > whose sizeof_partition_entry is not sizeof(gpt_entry), and one whose > entry array is larger than 4MiB (KMALLOC_MAX_SIZE in Linux with 4KiB > pages, 32768 entries). Larger entries are allowed by the UEFI > specification, but U-Boot has never read them correctly, and Linux does > not accept them either. > > The header size is checked before the CRC is computed over it. All the > checks are in validate_gpt_header(), so they also apply to the header > that is_valid_gpt_buf() checks when fastboot is sent a GPT. That path > still takes partition_entry_lba from the header without checking it > against the size of the download, which is left for a follow-up. > > Add a test that gives the primary header of a GPT on a blkmap device > each of these sizes, with CRCs to match, and checks that it is refused > and that the backup header is used instead. > > Signed-off-by: Ana Bobillo <[email protected]> > > disk/part_efi.c | 47 +++++++++++++-- > test/lib/part_efi.c | 163 > ++++++++++++++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 205 insertions(+), 5 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
