On 2026-10-28T05:50:48, Ana Bobillo <[email protected]> wrote: > disk: part_dos: Walk the extended partition tables in a bounded loop > > part_get_info_extended() and print_partition_extended() follow the > links from one extended partition table to the next by recursing, and > stop at MAX_EXT_PARTS partitions, the limit added for CVE-2019-13103. > But a link adds no partition: an extended partition table holding only > a link back to itself does not advance part_num, so the recursion goes > on until the stack runs out, whenever a logical partition of the device > is looked up. Even within the limit, every level keeps a buffer of one > block on the stack, so a long chain of tables on a device with large > blocks needs megabytes of stack. > > Follow the links in a loop instead, reusing the one buffer, with the > code that finds the next link in a helper, dos_next_table(), which both > functions use. As Linux does in parse_extended(), stop after > MAX_EXT_EMPTY (16) tables in a row that hold no partition: tables > linking back to each other are then given up after a few reads. Also > stop after MAX_EXT_TABLES tables in all, as many as MAX_EXT_PARTS > partitions need when each table holds one, so that no walk reads more > than that. A chain that also holds tables without a partition then > reads fewer than MAX_EXT_PARTS partitions; partitioning tools write one > logical partition per table. > > print_partition_extended() follows every link of a table, where > part_get_info_extended() follows only the first, so it can list > partitions that cannot be looked up, under numbers that clash, and its > walk is not a chain but a tree. Follow only the first link there too. > > Add tests with a table holding only a link between two logical > partitions and then a table that links only to itself, and with 15 and > 16 such tables in a row before a logical partition. > > Signed-off-by: Ana Bobillo <[email protected]> > > disk/part_dos.c | 289 > ++++++++++++++++++++++++++++++++------------------------ > test/dm/part.c | 175 ++++++++++++++++++++++++++++++++++ > 2 files changed, 340 insertions(+), 124 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
