[PATCH v2] md: fix out-of-bound by adding checks at store

[Aaditya Kansal <aadityakansal390@gmail.com>]

syzbot reported array-index-out-of-bounds in super_90_sync()
    UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17
    index 124 is out of range for type 'mdp_disk_t [27]'
    CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G    L
    syzkaller #0 PREEMPT(full)
    Tainted: [L]=SOFTLOCKUP
    Hardware name: Google Google Compute Engine/Google Compute Engine,
    BIOS Google 08/05/2026
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
     ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
     __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
     super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697
 ...

super_90_sync() exists for older version 0.90, which supports up to 27
maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks
for raid disks. The repro wrote higher value (124) in raid_disks sysfs
attribute to trigger this bug.

The repro is one configuration that triggers this bug, which is caused by
the lack of proper checks at sysfs stores. Store is one path to reach
OOB.

Add helper function md_check_disks_fit_metadata() and call it at
raid_disks_store() and metadata_store() to reject the write for
mismatched configuration (raid_disks > MD_SB_DISKS for major == 0). This
prevents invalid configuration via stores from reaching the super_90_sync
function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9e3014263a35700ab49b
Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
---
v2:
- moved the fix from super_90_sync() to a level above at store functions
- add checks at stores themselves to prevent wrong configuration from
  reaching the target function
- add helper function to be called at all the sites where check is
  required

 drivers/md/md.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..f0f693f6bf7c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1354,6 +1354,13 @@ int md_check_no_bitmap(struct mddev *mddev)
 }
 EXPORT_SYMBOL(md_check_no_bitmap);

+static int md_check_disks_fit_metadata(int major, int raid_disks)
+{
+	if (major == 0 && raid_disks > MD_SB_DISKS)
+		return -EINVAL;
+	return 0;
+}
+
 /*
  * load_super for 0.90.0
  */
@@ -4448,8 +4455,15 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
 		mddev->delta_disks = n - olddisks;
 		mddev->raid_disks = n;
 		mddev->reshape_backwards = (mddev->delta_disks < 0);
-	} else
+	} else {
+		err = md_check_disks_fit_metadata(mddev->major_version, n);
+		if (err) {
+			pr_warn("md: raid disks (%d) exceeds max disks (%d) for metadata version 0.90",
+					n, MD_SB_DISKS);
+			goto out_unlock;
+		}
 		mddev->raid_disks = n;
+	}
 out_unlock:
 	memalloc_noio_restore(noio_flags);
 	mddev_unlock_and_resume(mddev);
@@ -5041,6 +5055,13 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len)
 	err = -ENOENT;
 	if (major >= ARRAY_SIZE(super_types) || super_types[major].name == NULL)
 		goto out_unlock;
+
+	err = md_check_disks_fit_metadata(major, mddev->raid_disks);
+	if (err) {
+		pr_warn("md: metadata version 0.90 doesn't support raid disks count higher than %d",
+				MD_SB_DISKS);
+		goto out_unlock;
+	}
 	mddev->major_version = major;
 	mddev->minor_version = minor;
 	mddev->persistent = 1;
--
2.55.0