Skip to content

[drivers][block] reject GPT entries with ending_lba before starting_lba - #11978

Open
BernardXiong wants to merge 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/gpt-pte-underflow
Open

[drivers][block] reject GPT entries with ending_lba before starting_lba#11978
BernardXiong wants to merge 1 commit into
RT-Thread:masterfrom
BernardXiong:fix/gpt-pte-underflow

Conversation

@BernardXiong

@BernardXiong BernardXiong commented Nov 2, 2026

Copy link
Copy Markdown
Member

拉取/合并请求描述：(PR description)

为什么提交这份PR (why to submit this PR)

这是对 #11275 的重做（原 PR 已过时）。修复 #11271。

is_pte_valid() 只要求 starting_lba、ending_lba 都在磁盘范围内，没有检查 ending_lba >= starting_lba。构造一个 CRC 有效的 GPT 镜像即可让 efi_partition() 中的

size = ending_lba - starting_lba + 1ULL;

发生无符号下溢，得到一个巨大的分区大小，并作为逻辑分区注册。

你的解决方案是什么 (what is your solution)

  • 在 is_pte_valid() 中增加 end < start 判断，拒绝首尾颠倒的分区条目；
  • 把 start/size 的计算移到合法性检查之后，并用已校验的 start 计算 size，从源头避免下溢计算被求值。

改动只涉及 components/drivers/block/partitions/efi.c 一个文件，复用现有的 GPT 校验流程，没有引入新接口。

请提供验证的bsp和config (provide the config and bsp)

  • BSP: bsp/qemu-vexpress-a9

  • .config: CONFIG_RT_USING_BLK=y, CONFIG_RT_BLK_PARTITION_EFI=y

  • action: 已使用 arm-none-eabi 工具链本地编译 components/drivers/block/partitions/efi.c 通过；完整构建由 CI 验证。

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

  • 本拉取/合并请求是一个草稿版本 This PR is for a code-review and is intended to get feedback
  • 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

  • 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
  • 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
  • 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
  • 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
  • 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
  • 代码是高质量的 Code in this PR is of high quality
  • 已经使用clang-format 源码格式化工具确保格式符合RT-Thread代码规范 This PR has been formatted with clang-format and complies with RT-Thread code specification
  • 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

本 PR 由 DeepSeek 4.1 Flash 协同完成。

@BernardXiong DeepSeek 4.1 Flash
[drivers][block] reject GPT entries with ending_lba before starting_lba
c50e3d0 
is_pte_valid() accepted a GPT entry as long as both LBAs were inside the
disk, so a crafted image could set ending_lba < starting_lba. The size
computed in efi_partition() then underflowed to a huge value and was
registered as the logical partition size.

Reject entries whose end LBA is below the start LBA, and compute the
partition start/size only after the entry passed validation. This avoids
evaluating the underflow at all and reuses the validated start value for
the size calculation.

Fixes RT-Thread#11271.

Co-authored-by: DeepSeek 4.1 Flash <noreply@deepseek.com>
@BernardXiong BernardXiong mentioned this pull request Nov 2, 2026
Closed
@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

🛠 操作步骤 | Steps

  1. 前往 Actions 页面 | Go to the Actions page
    点击进入工作流 → | Click to open workflow →

  2. 点击 Run workflow | Click Run workflow

  • Use workflow from 保持默认分支（通常为 master）
    Keep the default branch (usually master) in Use workflow from
  • 在 branch 输入框填写 PR 分支 fix/gpt-pte-underflow
    Enter PR branch fix/gpt-pte-underflow in the branch field
  • 设置需排除的文件/目录（目录请以"/"结尾）
    Set files/directories to exclude (directories should end with "/")
  1. 等待工作流完成 | Wait for the workflow to complete
    格式化后的代码将作为独立提交推送至你的分支。
    The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 fix/gpt-pte-underflow 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix/gpt-pte-underflow branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)
  • components/drivers/block/partitions/efi.c

📊 Current Review Status (Last Updated: 2026-11-03 07:18 CST)

📝 Review Instructions

  1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
    Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

  2. 确认审核通过后评论 LGTM/lgtm
    Comment LGTM/lgtm after confirming approval

  3. PR合并前需至少一位维护者确认
    PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

@github-actions

github-actions Bot commented Nov 2, 2026

Copy link
Copy Markdown

MemBrowse Memory Report · Explore what changed →

nuvoton-m487

  • CODE: .text +48 B (+0.0%, 356,588 B / 524,288 B, total: 68% used)

No memory changes detected for:

Catch memory regressions in CI with MemBrowse. Free for open source.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

component: drivers Component

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BernardXiong