[PATCH master] partitions: efi: reject partitions with negative size

[Stefan Kerkmann]

From: "Bruno Produit (Patch the Planet in collaboration with OpenAI)" <bruno.produit at trailofbits.com>

Previously the GPT parser accepted a partition whose ending LBA is
smaller than its starting LBA. The sector-count calculation then wraped
and registered a partition with a negative file size. This is invalid
and caused out of bounds reads in the bootm 4-KiB image probe on 32-bit
systems.

Fixes: 760689e5ccf1 ("disk: partitions: add EFI GUID Partition Table")
Assisted-by: gpt-5.6-sol-cyber
Signed-off-by: Bruno Produit <bruno.produit at trailofbits.com>
Signed-off-by: Stefan Kerkmann <s.kerkmann at pengutronix.de>
---
 common/partitions/efi.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/common/partitions/efi.c b/common/partitions/efi.c
index 9a04b7014d..d3bda96b05 100644
--- a/common/partitions/efi.c
+++ b/common/partitions/efi.c
@@ -248,9 +248,13 @@ static int is_gpt_valid(struct block_device *blk, u64 lba,
 static inline int
 is_pte_valid(const gpt_entry *pte, const u64 lastlba)
 {
+	u64 start = le64_to_cpu(pte->starting_lba);
+	u64 end = le64_to_cpu(pte->ending_lba);
+
 	if (guid_is_null(&pte->partition_type_guid) ||
-	    le64_to_cpu(pte->starting_lba) > lastlba	 ||
-	    le64_to_cpu(pte->ending_lba)   > lastlba)
+	    start > lastlba ||
+	    end > lastlba ||
+	    start > end)
 		return 0;
 	return 1;
 }

---
base-commit: e55e492573e33823f25935ee00fe7fa7bf2c5c90
change-id: 20260909-fix-gpt-parser-92d361d6d384

Best regards,
--  
Stefan Kerkmann <s.kerkmann at pengutronix.de>