Re: [RFC PATCH v3 2/4] md: pass struct mdu_disk_info64 to md_add_new_disk()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] md: uninitialized info->raid_disk evaluation outside MD_DISK_SYNC flag gate
--

commit 2e047f45700e04ece53e9f9cfd19bd6bb0bd587c
Author: Abd-Alrhman Masalkhi <abd.masalkhi@gatech.edu>

md: pass struct mdu_disk_info64 to md_add_new_disk()

The md control device passes disk information as struct mdu_disk_info64.
Make md_add_new_disk() take this structure, so that the control device
and the old ADD_NEW_DISK ioctl can share it.

> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 154ee5a65cb79..be1634ae1d09c 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -8305,6 +8305,16 @@ static bool md_ioctl_need_suspend(unsigned int cmd)
>  	}
>  }
>  
> +static void convert_to_disk_info64(struct mdu_disk_info64 *info64,
> +				   mdu_disk_info_t *info)
> +{
> +	info64->number = info->number;
> +	info64->major = info->major;
> +	info64->minor = info->minor;
> +	info64->raid_disk = info->raid_disk;

[Severity: Medium]
If the ADD_NEW_DISK ioctl is called to add a hot spare without the
MD_DISK_SYNC flag set, is it guaranteed that userspace has initialized
info->raid_disk?

Userspace is not required to initialize the raid_disk field if the
MD_DISK_SYNC flag is absent, meaning it may contain arbitrary garbage.
The convert_to_disk_info64() helper copies this unconditionally.

When md_add_new_disk() proceeds to evaluate it:

	if (info->raid_disk < mddev->raid_disks)
		rdev->raid_disk = info->raid_disk;
	else
		rdev->raid_disk = -1;

could this evaluation outside of the MD_DISK_SYNC flag gate cause array
role corruption?

If the uninitialized garbage happens to be a positive integer less than
mddev->raid_disks, rdev->raid_disk might be mistakenly assigned this
garbage value instead of the expected -1 for a spare, potentially
breaking rebuilding logic.

> +	info64->state = info->state;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261007115104.13884-1-abd.masalkhi@gatech.edu?part=2