[PATCH] ubifs: fix out-of-bounds write in LPT commit padding

[Guanni Qu]

Hi Zhihao,

You're right. 'from' is always either 0 or c->nhead_offs, which is
ALIGN(offs, c->min_io_size) (line 524). Since leb_size is also a
multiple of min_io_size, from + alen can never exceed leb_size.

My validation used artificial values that don't occur in real
execution. I'll withdraw this patch.

Apologies for the noise.

Jenny

On Fri, Mar 13, 2026 at 7:15 PM Zhihao Cheng <chengzhihao1 at huawei.com> wrote:
>
> 在 2026/3/14 6:22, Jenny Guanni Qu 写道:
> > In write_cnodes(), when writing LPT data to a LEB, the code pads the
> > write buffer to min_io_size alignment using:
> >
> >      memset(buf + offs, 0xff, alen - wlen)
> >
> > where wlen = offs - from and alen = ALIGN(wlen, min_io_size). The
> > buffer (c->lpt_buf) is allocated with size c->leb_size. When offs is
> > near leb_size and from is non-zero, the alignment padding can push
> > the memset past the end of the buffer.
> >
> > For example, with leb_size=4096, offs=4000, from=3584, min_io_size=1024:
> >    wlen=416, alen=1024, padding=608 bytes at offset 4000
> >    writes to offsets 4000..4607, 512 bytes past the 4096-byte buffer
> Hi, Guanni
> How does 'from' become '3584'(which is not aligned with min_io_size[1024])?
> As far as I know, the 'from' comes from 'c->nhead_offs', which is always
> aligned with min_io_size.
> >
> > Clamp the padding size to not exceed the buffer boundary in all 4
> > instances of this pattern.
> >
> > The OOB write was confirmed with KASAN using a test module that
> > reproduces the arithmetic with matching buffer and alignment values.
> >
> > Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
> > Reported-by: Klaudia Kloc <klaudia at vidocsecurity.com>
> > Reported-by: Dawid Moczadło <dawid at vidocsecurity.com>
> > Tested-by: Jenny Guanni Qu <qguanni at gmail.com>
> > Signed-off-by: Jenny Guanni Qu <qguanni at gmail.com>
> > ---
> >   fs/ubifs/lpt_commit.c | 8 ++++----
> >   1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
> > index 07351fdce722..77a7a2cd418f 100644
> > --- a/fs/ubifs/lpt_commit.c
> > +++ b/fs/ubifs/lpt_commit.c
> > @@ -402,7 +402,7 @@ static int write_cnodes(struct ubifs_info *c)
> >                       wlen = offs - from;
> >                       if (wlen) {
> >                               alen = ALIGN(wlen, c->min_io_size);
> > -                             memset(buf + offs, 0xff, alen - wlen);
> > +                             memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> >                               err = ubifs_leb_write(c, lnum, buf + from, from,
> >                                                      alen);
> >                               if (err)
> > @@ -461,7 +461,7 @@ static int write_cnodes(struct ubifs_info *c)
> >               if (offs + c->lsave_sz > c->leb_size) {
> >                       wlen = offs - from;
> >                       alen = ALIGN(wlen, c->min_io_size);
> > -                     memset(buf + offs, 0xff, alen - wlen);
> > +                     memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> >                       err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> >                       if (err)
> >                               return err;
> > @@ -487,7 +487,7 @@ static int write_cnodes(struct ubifs_info *c)
> >               if (offs + c->ltab_sz > c->leb_size) {
> >                       wlen = offs - from;
> >                       alen = ALIGN(wlen, c->min_io_size);
> > -                     memset(buf + offs, 0xff, alen - wlen);
> > +                     memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> >                       err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> >                       if (err)
> >                               return err;
> > @@ -510,7 +510,7 @@ static int write_cnodes(struct ubifs_info *c)
> >       /* Write remaining data in buffer */
> >       wlen = offs - from;
> >       alen = ALIGN(wlen, c->min_io_size);
> > -     memset(buf + offs, 0xff, alen - wlen);
> > +     memset(buf + offs, 0xff, min_t(int, alen - wlen, c->leb_size - offs));
> >       err = ubifs_leb_write(c, lnum, buf + from, from, alen);
> >       if (err)
> >               return err;
> >
>