[syzbot] [mtd?] WARNING in add_mtd_device

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a975094bf98c Merge tag 'exfat-for-7.2-rc1' of git://git.ke..
git tree: https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master
console output: https://syzkaller.appspot.com/x/log.txt?x=16e3dd56580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3c66dc15e483c558
dashboard link: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
compiler: aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/fa3fbcfdac58/non_bootable_disk-a975094b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/56fd6dc1b679/vmlinux-a975094b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b1422518a402/Image-a975094b.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3ae802...@syzkaller.appspotmail.com

mtd partition "" doesn't have enough space: 0x8000003 < 0x8000084bb, disabled
------------[ cut here ]------------
WARNING: drivers/mtd/mtdcore.c:719 at add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719, CPU#1: syz.0.5209/17410
Modules linked in:
CPU: 1 UID: 0 PID: 17410 Comm: syz.0.5209 Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719
lr : mtd_add_partition+0x218/0x48c drivers/mtd/mtdpart.c:280
sp : ffff80008e3b76f0
x29: ffff80008e3b77b0 x28: ffff000015758000 x27: ffff00001783c004
x26: 1fffe00002f0783f x25: ffff00001783c014 x24: 0000000000000004
x23: ffff00001783c000 x22: 1ffff00011c76f02 x21: 0000000000000000
x20: ffff00001783c1a0 x19: 0000000000000c00 x18: 0000000000000000
x17: 3830303030387830 x16: 203c203330303030 x15: 30387830203a6563
x14: 617073206867756f x13: 0000000000000001 x12: ffff700011c76ee9
x11: 1ffff00011c76ee8 x10: ffff700011c76ee8 x9 : dfff800000000000
x8 : ffff80008e3b7747 x7 : 1ffff00011c76eea x6 : 0000000041b58ab3
x5 : ffff700011c76eea x4 : ffff80008e3b7750 x3 : 1fffe00002f07800
x2 : 0000000000000000 x1 : 0000000000000007 x0 : 0000000000000000
Call trace:
add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719 (P)
mtd_add_partition+0x218/0x48c drivers/mtd/mtdpart.c:280
mtdchar_blkpg_ioctl+0x17c/0x1b8 drivers/mtd/mtdchar.c:562
mtdchar_ioctl+0x2f8/0x1ed8 drivers/mtd/mtdchar.c:1218
mtdchar_unlocked_ioctl+0xa0/0xfc drivers/mtd/mtdchar.c:1241
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__arm64_sys_ioctl+0x124/0x1a4 fs/ioctl.c:583
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49
el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121
do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:140
el0_svc+0x58/0x2a4 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [<ffff800080215cc8>] copy_process+0x16a8/0x5700 kernel/fork.c:2232
softirqs last enabled at (0): [<ffff800080215ce8>] copy_process+0x16c8/0x5700 kernel/fork.c:2233
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a975094bf98c Merge tag 'exfat-for-7.2-rc1' of git://git.ke..
git tree: https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux master

console output: https://syzkaller.appspot.com/x/log.txt?x=146d82fe580000

kernel config: https://syzkaller.appspot.com/x/.config?x=3c66dc15e483c558
dashboard link: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
compiler: aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13d3dd56580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17a9050e580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/fa3fbcfdac58/non_bootable_disk-a975094b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/56fd6dc1b679/vmlinux-a975094b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b1422518a402/Image-a975094b.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3ae802...@syzkaller.appspotmail.com

mtd partition "" doesn't have enough space: 0x8000003 < 0x8000084bb, disabled
------------[ cut here ]------------

WARNING: drivers/mtd/mtdcore.c:719 at add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719, CPU#0: syz.2.17/3665
Modules linked in:
CPU: 0 UID: 0 PID: 3665 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT

Hardware name: linux,dummy-virt (DT)
pstate: 10000005 (nzcV daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : add_mtd_device+0x56c/0x14cc drivers/mtd/mtdcore.c:719
lr : mtd_add_partition+0x218/0x48c drivers/mtd/mtdpart.c:280

sp : ffff8000a2c276f0
x29: ffff8000a2c277b0 x28: ffff0000158a8000 x27: ffff00001ef34004
x26: 1fffe00003de683f x25: ffff00001ef34014 x24: 0000000000000004
x23: ffff00001ef34000 x22: 1ffff00014584f02 x21: 0000000000000000
x20: ffff00001ef341a0 x19: 0000000000000c00 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008764b708
x14: 1ffff00010ec96e1 x13: 0000000000000004 x12: ffff700014584ee9
x11: 1ffff00014584ee8 x10: ffff700014584ee8 x9 : dfff800000000000
x8 : ffff8000a2c27747 x7 : 1ffff00014584eea x6 : 0000000041b58ab3
x5 : ffff700014584eea x4 : ffff8000a2c27750 x3 : 1fffe00003de6800

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] mtd: mtdpart: validate partition bounds in mtd_add_partition()
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


mtd_add_partition() checks that 'length' is positive but does not
validate that 'offset + length' fits within the parent partition's
size. A userspace caller using the BLKPG_ADD_PARTITION ioctl can
supply a crafted large 'length' value that passes the length <= 0
check, causing add_mtd_device() to fire a WARN_ON() when it detects
the oversized partition.

Fix this by adding explicit bounds checks before allocate_partition()
is called:
- Reject negative or out-of-range offsets.
- Use u64 arithmetic to safely check offset + length <= parent_size,
avoiding potential signed integer overflow.

Reported-by: syzbot+3ae802...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
drivers/mtd/mtdpart.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index 795a94e6b482..1a0e2207e440 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -264,6 +264,11 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
if (length <= 0)
return -EINVAL;

+ if (offset < 0 || offset >= (long long)parent_size)
+ return -EINVAL;
+
+ if ((u64)offset + (u64)length > parent_size)
+ return -EINVAL;
memset(&part, 0, sizeof(part));
part.name = name;
part.size = length;
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+3ae802...@syzkaller.appspotmail.com
Tested-by: syzbot+3ae802...@syzkaller.appspotmail.com

Tested on:

commit: 1a3746cc Merge tag 'strncpy-removal-v7.2-rc1' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=138f74fe580000

kernel config: https://syzkaller.appspot.com/x/.config?x=3c66dc15e483c558
dashboard link: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
compiler: aarch64-linux-gnu-gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
userspace arch: arm64

patch: https://syzkaller.appspot.com/x/patch.diff?x=12060afe580000

Note: testing is done by a robot and is best-effort only.