Re: [PATCH] md: add max_disks bound check in older version

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Skipping disk descriptor assignment via `continue` leaves `rdev->desc_nr` unhandled, causing out-of-bounds array reads or silent metadata corruption when assigning `sb->this_disk`.
--

commit c2add8f93f69d601b2a3935bff10c239b5018489
Author: Aaditya Kansal <aadityakansal390@gmail.com>

md: add max_disks bound check in older version

This commit adds a bounds check to prevent raid_disks from exceeding
the maximum allowed disks for version 0.90 superblocks. It prints a warning
and skips processing for devices that exceed this limit.

> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 680b34a63cb3d..f5fce41637f12 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1693,6 +1693,12 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev)
>  			desc_nr = rdev2->raid_disk;
>  		else
>  			desc_nr = next_spare++;
> +
> +		if (desc_nr >= MD_SB_DISKS) {
> +			pr_warn("md: raid_disks = %d exceeds max_disks = %d for version 0.90\n",
> +					desc_nr, MD_SB_DISKS);
> +			continue;
> +		}

[Severity: High]
Does skipping the disk descriptor assignment here leave the descriptor number
unhandled?

If an array has enough devices such that a newly added spare reaches
MD_SB_DISKS, this continue statement skips setting the descriptor number.
Since new devices are initialized with a value of -1, it remains -1.

After the loop, the descriptor is used unconditionally:

drivers/md/md.c:super_90_sync() {
    ...
    sb->this_disk = sb->disks[rdev->desc_nr];
    sb->sb_csum = calc_sb_csum(sb);
}

Can this lead to an out-of-bounds array read if rdev->desc_nr is negative or
invalid?

This is a pre-existing issue, but super_90_validate() blindly uses the
descriptor number read from the on-disk superblock to index the disks array:

drivers/md/md.c:super_90_validate() {
    ...
    if (sb->disks[rdev->desc_nr].state & (
    ...
}

If the bounds are not strictly enforced, could a crafted disk image trigger
an out-of-bounds read there as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913234627.465492-1-aadityakansal390@gmail.com?part=1