partitions: aix: bound the pp_count scan to the ppe array

aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:

	int numpps = be16_to_cpu(pvd->pp_count);
	...
	for (i = 0; i < numpps; i += 1) {
		struct ppe *p = pvd->ppe + i;
		...
		lp_ix = be16_to_cpu(p->lp_ix);

pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count.  pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).

The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().

Clamp the scan to the number of entries the ppe[] array can hold.

Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Acked-by: Philippe De Muyter <phdm@macqel.be>
Link: https://patch.msgid.link/20260607064137.302574-1-hexlabsecurity@proton.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/partitions/aix.c b/block/partitions/aix.c
index 29b8f4cebb63d546731d1e2892d6a601996f2e14..f3c4174e003e9d6e049657a7b7d1eb91db500fe8 100644 (file)
--- a/block/partitions/aix.c
+++ b/block/partitions/aix.c
@@ -226,6 +226,15 @@ int aix_partition(struct parsed_partitions *state)
                int next_lp_ix = 1;
                int lp_ix;
 
+               /*
+                * pvd was read into a fixed-size struct pvd whose ppe[] array
+                * holds ARRAY_SIZE(pvd->ppe) entries.  pp_count is an
+                * unvalidated on-disk __be16, so clamp the scan to the array
+                * size to avoid walking past the allocation.
+                */
+               if (numpps > ARRAY_SIZE(pvd->ppe))
+                       numpps = ARRAY_SIZE(pvd->ppe);
+
                for (i = 0; i < numpps; i += 1) {
                        struct ppe *p = pvd->ppe + i;
                        unsigned int lv_ix;