From: David Bauer Date: Wed, 22 Jul 2026 22:58:00 +0000 (+0200) Subject: mtd mtdsplit-fit: fix fit not found case X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f8386008c0110969ca02032af7a2effbd90f395c;p=thirdparty%2Fopenwrt.git mtd mtdsplit-fit: fix fit not found case Attempting to parse the mtdsplit-fit device can lead in a out of bounds read error, as the driver did not validate a fit was found at all. This can happen if the fit size in the header at the last scan iteration is non-zero. In this case, the dmesg reads: [ 6.563676] Creating 6 MTD partitions on "ec000000.nor": [ 6.569058] 0x000000000000-0x000003d60000 : "firmware" [ 6.579192] read error in "firmware" at offset 0x3d60000 [ 6.584534] Failed to parse subpartitions: -22 [ 6.589010] Deleting MTD partitions on "ec000000.nor": Validate after the scan loop if a fit image was found and abort in this stage if it is not found. Signed-off-by: David Bauer --- diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c index 2afc19d09f4..276e9fc9e1e 100644 --- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c +++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c @@ -206,6 +206,7 @@ mtdsplit_fit_parse(struct mtd_info *mtd, struct mtd_partition *parts; int ret, ndepth, noffset, images_noffset; const void *img_data; + bool found_fit = false; void *fit; of_property_read_string(np, "openwrt,cmdline-match", &cmdline_match); @@ -238,9 +239,15 @@ mtdsplit_fit_parse(struct mtd_info *mtd, } /* We found a FIT image. Let's keep going */ + found_fit = true; break; } + if (!found_fit) { + pr_info("No FIT image found in \"%s\"\n", mtd->name); + return -ENOENT; + } + fit_offset = offset; fit_size = be32_to_cpu(hdr.totalsize);