[PATCH v2] mtd: core: reject OOB transfers with no complete page remaining

[James Hilliard]

mtd_check_oob_ops() permits offs == mtd->size when the data length is
zero. For an OOB-only request with a nonzero ooboffs, maxooblen then
underflows because there are no pages remaining. The wrapped value lets
the request pass the OOB length check.

The OOB ioctls can reach this case by encoding the OOB offset in the low
bits of start. On a partition ending before its master device, the
subsequent address translation allows the request to read or write OOB
in the page immediately following the partition.

The same underflow is possible before the device end on a read-only
partition whose size is not a multiple of writesize. An offset in its
trailing partial page has the same page index as mtd->size, so the
remaining-page count is zero even though offs < mtd->size.

Reject nonempty OOB requests whose starting page is at or beyond the
number of complete pages in the MTD device, before subtracting ooboffs
from the remaining OOB capacity. This covers both exact EOF and trailing
partial pages while preserving data-only and empty-request validation.

Fixes: d82c36821684 ("mtd: Fix mtd_check_oob_ops()")
Cc: stable at vger.kernel.org
Link: https://lore.kernel.org/r/sashiko-outbox-197995@kernel.org
Signed-off-by: James Hilliard <james.hilliard1 at gmail.com>
---
Changes in v2:
- Compare page indices to reject OOB requests in a trailing partial page
  as well as at EOF, addressing Sashiko's review.
- Link to v1: https://patch.msgid.link/20261104-submit-mtd-oob-end-v1-v1-1-5cb8ad921cb0@gmail.com
---
 drivers/mtd/mtdcore.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 491a27d0315f..34ab30df03a0 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1676,6 +1676,10 @@ static int mtd_check_oob_ops(struct mtd_info *mtd, loff_t offs,
 	if (ops->ooblen) {
 		size_t maxooblen;
 
+		if (mtd_div_by_ws(offs, mtd) >=
+		    mtd_div_by_ws(mtd->size, mtd))
+			return -EINVAL;
+
 		if (ops->ooboffs >= mtd_oobavail(mtd, ops))
 			return -EINVAL;
 

---
base-commit: 1c1a342aceec79528b3ba51f376eca2be5928fe7
change-id: 20261104-submit-mtd-oob-end-v1-f4dc6fbfcfca

Best regards,
--  
James Hilliard <james.hilliard1 at gmail.com>