Re: [PATCH 3/6] disk: part_mac: Fix stack corruption on devices with large blocks

On 2026-07-31T12:39:59, Alexey Charkov <[email protected]> wrote:
> disk: part_mac: Fix stack corruption on devices with large blocks
>
> part_test_mac(), part_print_mac() and part_get_info_mac() each declare a
> single-block buffer sized after the descriptor struct:
>
>         ALLOC_CACHE_ALIGN_BUFFER(mac_driver_desc_t, ddesc, 1);
>         ALLOC_CACHE_ALIGN_BUFFER(mac_partition_t, mpart, 1);
>
> Both structs are 512 bytes, but every blk_dread() below them asks for one
> block, which transfers desc->blksz bytes. On a device with 4096-byte
> logical blocks that writes 4096 bytes into a 512-byte on-stack buffer and
> corrupts the stack.
>
> part_test_mac() runs on every block device during partition probing, so on
> sandbox with CONFIG_MAC_PARTITION=y this crashes on any access at all to a
> device with large blocks, for instance:
>
>         host bind 0 disk.img 4096
>         part list host 0
>
> Pad the buffers out to the block size with ALLOC_CACHE_ALIGN_BUFFER_PAD(),
> which is what part_efi.c already does for its own block buffers.
>
> Signed-off-by: Alexey Charkov <[email protected]>
> Reviewed-by: Ilias Apalodimas <[email protected]>
>
> disk/part_mac.c | 12 ++++++------
>  1 file changed, 6 insertions(+), 6 deletions(-)

Reviewed-by: Simon Glass <[email protected]>