mtd_check_oob_ops() permits offs == mtd->size when the data length is zero. For an OOB-only request with a nonzero ooboffs, maxooblen then underflows because there are no pages remaining. The wrapped value lets the request pass the OOB length check. The OOB ioctls can reach this case by encoding the OOB offset in the low bits of start. On a partition ending before its master device, the subsequent address translation allows the request to read or write OOB in the page immediately following the partition. Reject nonempty OOB transfers starting at or beyond the end of the MTD device before calculating the remaining OOB capacity. Keep empty requests and data-only operations unchanged. Fixes: d82c36821684 ("mtd: Fix mtd_check_oob_ops()") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard --- drivers/mtd/mtdcore.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 491a27d0315f..b82fd7ccd111 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -1676,6 +1676,9 @@ static int mtd_check_oob_ops(struct mtd_info *mtd, loff_t offs, if (ops->ooblen) { size_t maxooblen; + if (offs >= mtd->size) + return -EINVAL; + if (ops->ooboffs >= mtd_oobavail(mtd, ops)) return -EINVAL; --- base-commit: 1c1a342aceec79528b3ba51f376eca2be5928fe7 change-id: 20261104-submit-mtd-oob-end-v1-f4dc6fbfcfca Best regards, -- James Hilliard