partitions: mac: fix handling of bogus partition table

commit 80e648042e512d5a767da251d44132553fe04ae0 upstream.

Fix several issues in partition probing:

 - The bailout for a bad partoffset must use put_dev_sector(), since the
   preceding read_part_sector() succeeded.
 - If the partition table claims a silly sector size like 0xfff bytes
   (which results in partition table entries straddling sector boundaries),
   bail out instead of accessing out-of-bounds memory.
 - We must not assume that the partition table contains proper NUL
   termination - use strnlen() and strncmp() instead of strlen() and
   strcmp().

Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/block/partitions/mac.c b/block/partitions/mac.c
index b6095335636c917908330929a059c44536e4392b..ca619d85275723388ca039ff870dac8c01937743 100644 (file)
--- a/block/partitions/mac.c
+++ b/block/partitions/mac.c
@@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state)
        }
        secsize = be16_to_cpu(md->block_size);
        put_dev_sector(sect);
+
+       /*
+        * If the "block size" is not a power of 2, things get weird - we might
+        * end up with a partition straddling a sector boundary, so we wouldn't
+        * be able to read a partition entry with read_part_sector().
+        * Real block sizes are probably (?) powers of two, so just require
+        * that.
+        */
+       if (!is_power_of_2(secsize))
+               return -1;
        datasize = round_down(secsize, 512);
        data = read_part_sector(state, datasize / 512, &sect);
        if (!data)
                return -1;
        partoffset = secsize % 512;
-       if (partoffset + sizeof(*part) > datasize)
+       if (partoffset + sizeof(*part) > datasize) {
+               put_dev_sector(sect);
                return -1;
+       }
        part = (struct mac_partition *) (data + partoffset);
        if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) {
                put_dev_sector(sect);
@@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state)
                                int i, l;
 
                                goodness++;
-                               l = strlen(part->name);
-                               if (strcmp(part->name, "/") == 0)
+                               l = strnlen(part->name, sizeof(part->name));
+                               if (strncmp(part->name, "/", sizeof(part->name)) == 0)
                                        goodness++;
                                for (i = 0; i <= l - 4; ++i) {
                                        if (strncasecmp(part->name + i, "root",