aix_partition() reads the logical-volume descriptor array as a single
sector and then scans it:

	if (numlvs && (d = read_part_sector(state, vgda_sector + 1, &sect))) {
		struct lvd *p = (struct lvd *)d;
		...
		for (i = 0; foundlvs < numlvs && i < state->limit; i++) {
			lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps);

p points at a single 512-byte sector, which holds SECTOR_SIZE /
sizeof(struct lvd) = 16 entries, but the loop runs until foundlvs reaches
the on-disk numlvs or i reaches state->limit (DISK_MAX_PARTS, 256).
numlvs is an on-disk __be16 read straight from the volume group
descriptor and is not validated, so a crafted AIX image with numlvs
larger than 16 and lvd entries whose num_lps fields are zero (so foundlvs
never advances) drives the loop to read p[i] well past the end of the
read sector buffer.

Commit d97a86c170b4 ("partitions: aix.c: off by one bug") hardened the
matching write of lvip[lv_ix] in 2014 but left this read loop unbounded.

Bound the scan to the number of struct lvd entries that fit in the
sector that was actually read.

Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
v2: use SECTOR_SIZE instead of the literal 512 and i++ instead of
    i += 1 in the bounded loop, per Hannes Reinecke's review.
v1: https://lore.kernel.org/linux-block/20260606170721.1530005-1-michael.bommarito@gmail.com/

Evidence: reproduced behaviorally on UML+KASAN (v7.1-rc4,
CONFIG_AIX_PARTITION): a crafted AIX LVM image with numlvs > 16 and lvd
entries whose num_lps are zero drives p[i] to read past the single
512-byte sector read for the descriptor array.  The read lands on a
page-cache folio (not slab), so KASAN-generic does not splat; the
instrumented run shows the index walking to state->limit (256) instead of
stopping at the 16 entries that fit the sector, and the patched build
stops at 16.  Built clean, no new warnings.

 block/partitions/aix.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/block/partitions/aix.c b/block/partitions/aix.c
index f3c4174e003e9..689837deba279 100644
--- a/block/partitions/aix.c
+++ b/block/partitions/aix.c
@@ -208,7 +208,14 @@ int aix_partition(struct parsed_partitions *state)
 		if (n) {
 			int foundlvs = 0;
 
-			for (i = 0; foundlvs < numlvs && i < state->limit; i += 1) {
+			/*
+			 * The lvd array was read as a single sector; only the
+			 * struct lvd entries that fit in it are valid.  Bound the
+			 * scan so an on-disk numlvs larger than that cannot walk
+			 * the read buffer out of bounds.
+			 */
+			for (i = 0; foundlvs < numlvs && i < state->limit &&
+				    i < SECTOR_SIZE / (int)sizeof(struct lvd); i++) {
 				lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps);
 				if (lvip[i].pps_per_lv)
 					foundlvs += 1;
-- 
2.53.0

On Tue, 14 Jul 2026 07:48:06 -0400, Michael Bommarito wrote:
> aix_partition() reads the logical-volume descriptor array as a single
> sector and then scans it:
> 
> 	if (numlvs && (d = read_part_sector(state, vgda_sector + 1, &sect))) {
> 		struct lvd *p = (struct lvd *)d;
> 		...
> 		for (i = 0; foundlvs < numlvs && i < state->limit; i++) {
> 			lvip[i].pps_per_lv = be16_to_cpu(p[i].num_lps);
> 
> [...]

Applied, thanks!

[1/1] partitions: aix: bound the lvd scan to one sector
      commit: d35e236282992e583ed9c1b7ab52e9ef1b873585

Best regards,
-- 
Jens Axboe