Re: [PATCH] block: partitions: reject GPT entries with starting_lba > ending_lba

[Jens Axboe]

On Mon, 02 Nov 2026 16:04:42 +0800, Zizhi Wo wrote:
> A GPT entry whose starting_lba is greater than its ending_lba is accepted,
> and the kernel creates a partition with a bogus size. The bogus sector
> count defeats the end-of-device check, so I/O through that partition is not
> confined to it and can access sectors outside the partition on the same
> disk.
> 
> is_pte_valid() only rejects an entry when its type is NULL or when
> starting_lba or ending_lba is greater than lastlba; it never checks that
> starting_lba <= ending_lba. For a reversed entry both field checks still
> pass, but efi_partition() computes size = ending_lba - starting_lba + 1 in
> u64, which underflows to a huge value. That value also wraps in the
> end-of-device check in blk_add_partition() (from + size) and does not fit
> the signed i_size, which turns negative.
> 
> [...]

Applied, thanks!

[1/1] block: partitions: reject GPT entries with starting_lba > ending_lba
      commit: 7e3801d12ebabaa3db6e2685ccc80b6e6f6d1ff7

Best regards,
-- 
Jens Axboe