[PATCH] mtd: inftl: validate MediaHeader partition geometry before allocating tables

[Miquel Raynal]

Hi Henry,

On 02/09/2026 at 20:40:19 +08, henrymei <ljp1205831794 at gmail.com> wrote:

> From: Aohan Mei <henrymei at tencent.com>
>
> find_boot_record() trusts the on-flash INFTL MediaHeader partition
> fields without validating their relationship to each other or to the
> device geometry.
>
> The sanity check
>
> 	if ((ip->lastUnit - ip->firstUnit + 1) < ip->virtualUnits)
>
> is evaluated in unsigned 32-bit arithmetic.  With lastUnit < firstUnit

lastUnit < firstUnit? Did you even read that sentence?

Sorry but, no.

Thanks,
Miquèl