Michael Bommarito d35e236282 partitions: aix: bound the lvd scan to one sector ... aix_partition() reads the logical-volume descriptor array as a single sector and then scans it: if (numlvs && (d = read_part_sector(state, vgda_sector + 1, &sect))) { struct lvd *p = (struct lvd *)d; ... for (i = 0; foundlvs < numlvs && i < state->limit; i++) { lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps); p points at a single 512-byte sector, which holds SECTOR_SIZE / sizeof(struct lvd) = 16 entries, but the loop runs until foundlvs reaches the on-disk numlvs or i reaches state->limit (DISK_MAX_PARTS, 256). numlvs is an on-disk __be16 read straight from the volume group descriptor and is not validated, so a crafted AIX image with numlvs larger than 16 and lvd entries whose num_lps fields are zero (so foundlvs never advances) drives the loop to read p[i] well past the end of the read sector buffer. Commit d97a86c170 ("partitions: aix.c: off by one bug") hardened the matching write of lvip[lv_ix] in 2014 but left this read loop unbounded. Bound the scan to the number of struct lvd entries that fit in the sector that was actually read. Fixes: 6ceea22bbb ("partitions: add aix lvm partition support files") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260714114806.3761553-1-michael.bommarito@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>		2026-07-15 16:32:49 -06:00
..
acorn.c	block/partitions/acorn: use min in {riscix,linux}_partition	2026-06-02 11:14:52 -06:00
aix.c	partitions: aix: bound the lvd scan to one sector	2026-07-15 16:32:49 -06:00
amiga.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
atari.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
atari.h	block: declare all partition detection routines in check.h	2020-03-24 07:57:08 -06:00
check.h	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
cmdline.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
core.c	block: partitions: replace __get_free_page() with kmalloc()	2026-05-27 08:34:32 -06:00
efi.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
efi.h	block: remove genhd.h	2022-02-02 07:49:59 -07:00
ibm.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
karma.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
Kconfig	block: add support for partition table defined in OF	2024-10-22 08:14:56 -06:00
ldm.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
ldm.h	partitions: ldm: remove the initial kernel-doc notation	2025-01-13 07:47:19 -07:00
mac.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
mac.h	block: declare all partition detection routines in check.h	2020-03-24 07:57:08 -06:00
Makefile	block: add support for partition table defined in OF	2024-10-22 08:14:56 -06:00
msdos.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
of.c	block: partitions: fix of_node refcount leak in of_partition()	2026-05-26 09:52:20 -06:00
osf.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
sgi.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
sun.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
sysv68.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00
ultrix.c	block: partitions: Replace pp_buf with struct seq_buf	2026-03-21 08:27:08 -06:00