[PATCH] ubifs: fix out-of-bounds write in LPT commit padding

[Zhihao Cheng]

在 2026/3/14 6:22, Jenny Guanni Qu 写道:
> In write_cnodes(), when writing LPT data to a LEB, the code pads the
> write buffer to min_io_size alignment using:
> 
>      memset(buf + offs, 0xff, alen - wlen)
> 
> where wlen = offs - from and alen = ALIGN(wlen, min_io_size). The
> buffer (c->lpt_buf) is allocated with size c->leb_size. When offs is
> near leb_size and from is non-zero, the alignment padding can push
> the memset past the end of the buffer.
> 
> For example, with leb_size=4096, offs=4000, from=3584, min_io_size=1024:
>    wlen=416, alen=1024, padding=608 bytes at offset 4000
>    writes to offsets 4000..4607, 512 bytes past the 4096-byte buffer
Hi, Guanni
How does 'from' become '3584'(which is not aligned with min_io_size[1024])?
As far as I know, the 'from' comes from 'c->nhead_offs', which is always 
aligned with min_io_size.
> 
> Clamp the padding size to not exceed the buffer boundary in all 4
> instances of this pattern.
> 
> The OOB write was confirmed with KASAN using a test module that
> reproduces the arithmetic with matching buffer and alignment values.
> 
> Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> Reported-by: Klaudia Kloc <klaudia at vidocsecurity.com>
> Reported-by: Dawid Moczadło <dawid at vidocsecurity.com>
> Tested-by: Jenny Guanni Qu <qguanni at gmail.com>
> Signed-off-by: Jenny Guanni Qu <qguanni at gmail.com>
> ---
>   fs/ubifs/lpt_commit.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
> index 07351fdce722..77a7a2cd418f 100644
> --- a/fs/ubifs/lpt_commit.c
> +++ b/fs/ubifs/lpt_commit.c
> @@ -402,7 +402,7 @@ static int write_cnodes(struct ubifs_info *c)
>   			wlen = offs - from;
>   			if (wlen) {
>   				alen = ALIGN(wlen, c->min_io_size);
> -				memset(buf + offs, 0xff, alen - wlen);
> +				memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
>   				err = ubifs_leb_write(c, lnum, buf + from, from,
>   						       alen);
>   				if (err)
> @@ -461,7 +461,7 @@ static int write_cnodes(struct ubifs_info *c)
>   		if (offs + c->lsave_sz > c->leb_size) {
>   			wlen = offs - from;
>   			alen = ALIGN(wlen, c->min_io_size);
> -			memset(buf + offs, 0xff, alen - wlen);
> +			memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
>   			err = ubifs_leb_write(c, lnum, buf + from, from, alen);
>   			if (err)
>   				return err;
> @@ -487,7 +487,7 @@ static int write_cnodes(struct ubifs_info *c)
>   		if (offs + c->ltab_sz > c->leb_size) {
>   			wlen = offs - from;
>   			alen = ALIGN(wlen, c->min_io_size);
> -			memset(buf + offs, 0xff, alen - wlen);
> +			memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
>   			err = ubifs_leb_write(c, lnum, buf + from, from, alen);
>   			if (err)
>   				return err;
> @@ -510,7 +510,7 @@ static int write_cnodes(struct ubifs_info *c)
>   	/* Write remaining data in buffer */
>   	wlen = offs - from;
>   	alen = ALIGN(wlen, c->min_io_size);
> -	memset(buf + offs, 0xff, alen - wlen);
> +	memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
>   	err = ubifs_leb_write(c, lnum, buf + from, from, alen);
>   	if (err)
>   		return err;
>