[PATCH] mtd: parsers: afs: add size check to v2 partition

[Griffin Kroah-Hartman]

On 8/25/26 3:42 PM, Miquel Raynal wrote:
> Hello Griffin,
>
> Thanks for the patch!
>
> On 24/08/2026 at 15:50:27 +02, Griffin Kroah-Hartman <griffin at kroah.com> wrote:
>
>> Add a size check to the loop in afs_parse_v2_partition(), avoiding
>> walking out of the imginfo[] array bounds if a malicious packet fakes a
> "packet" refers to network wording, whereas here, in the MTD world, we
> would rather talk about a malicious image.
Good to know! thanks for clarifying.
>> ---
>>   drivers/mtd/parsers/afs.c | 12 +++++++++---
>>   1 file changed, 9 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c
>> index 26116694c821..2c6f8768312c 100644
>> --- a/drivers/mtd/parsers/afs.c
>> +++ b/drivers/mtd/parsers/afs.c
>> @@ -287,12 +287,18 @@ static int afs_parse_v2_partition(struct mtd_info *mtd,
>>   		 block_start, block_end);
>>   
>>   	for (i = 0; i < region_count; i++) {
>> -		u32 region_load_addr = imginfo[pad + 3 + i*4];
>> -		u32 region_size = imginfo[pad + 4 + i*4];
>> -		u32 region_offset = imginfo[pad + 5 + i*4];
>> +		u32 region_load_addr;
>> +		u32 region_size;
>> +		u32 region_offset;
>>   		u32 region_start;
>>   		u32 region_end;
>>   
>> +		if (pad + 5 + i*4 >= ARRAY_SIZE(imginfo))
>> +			break;
>> +		region_load_addr = imginfo[pad + 3 + i*4];
>> +		region_size = imginfo[pad + 4 + i*4];
>> +		region_offset = imginfo[pad + 5 + i*4];
>> +
> Looking at the code, I see that just above the loop there is an actual
> check bailing out early in case the region count is overly big. In
> practice:
> - pad can only be 0, 1 or 2
> - imginfo array size is 36
>
> The check is:
>
>          if (region_count > (ARRAY_SIZE(imginfo) - pad - 3) / 4)
>                  return -EINVAL;
Sorry, I was not using linux-next, so I did not see that this was 
already checked.
Thank you for the review!

Griffin