CVE-2026-89557: md: do overflow check for sb->bblog_shift in super_1_load()

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

md: do overflow check for sb->bblog_shift in super_1_load()

In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-
disk superblock. It is used for badblocks API badblocks_set() by the
following sequence,

 1930   rdev->badblocks.shift = sb->bblog_shift;
 1931   for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {
 1932           u64 bb = le64_to_cpu(*bbp);
 1933           int count = bb & (0x3ff);
 1934           u64 sector = bb >> 10;
 1935           sector <<= sb->bblog_shift;
 1936           count <<= sb->bblog_shift;
 1937           if (bb + 1 == 0)
 1938                   break;
 1939           if (!badblocks_set(&rdev->badblocks, sector, count, 1))
 1940                   return -EINVAL;
 1941   }

bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for
an invalid bb->bblog_shit, it is possible to make sector be overflowed
by the following calculation,
 1935           sector <<= sb->bblog_shift;
Then in turn when call badblocks_set() at line 1939 with the invalid
rdev->badblocks.shift set at line 1930, may result an overflow inside
_badblocks_clear() in block/badblocks.c.

Although there are many places to call badblocks APIs, the non-zero
shift value is only used in super_1_load(), other places always use 0 as
the shift value. Therefore it is unnecessary to do a general shift value
overflow check inside badblock API, and just check here as the caller.

This may avoid unnecessary check, make the badblocks API code more simple
and elegant.

The Linux kernel CVE team has assigned CVE-2026-89557 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.1 with commit 2699b67223aca6b1450fc2f72e40fada952afc85 and fixed in 6.12.109 with commit 75d15738fd33a782606d0dc80cfeff47edf2ddd8
	Issue introduced in 3.1 with commit 2699b67223aca6b1450fc2f72e40fada952afc85 and fixed in 6.18.50 with commit 3b097416b4cff77285c1f472fc2c4058d8a7554f
	Issue introduced in 3.1 with commit 2699b67223aca6b1450fc2f72e40fada952afc85 and fixed in 7.2.4 with commit df7d4d011d5ace20699ea948712f09f9ac08924f
	Issue introduced in 3.1 with commit 2699b67223aca6b1450fc2f72e40fada952afc85 and fixed in 7.3-rc1 with commit 35d522bd32462afcf1981dab6da8a9256c26c1e0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89557
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/md/md.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/75d15738fd33a782606d0dc80cfeff47edf2ddd8
	https://git.kernel.org/stable/c/3b097416b4cff77285c1f472fc2c4058d8a7554f
	https://git.kernel.org/stable/c/df7d4d011d5ace20699ea948712f09f9ac08924f
	https://git.kernel.org/stable/c/35d522bd32462afcf1981dab6da8a9256c26c1e0