Re: [PATCH v2] md: fix out-of-bound by adding checks at store

[Aaditya Kansal <aadityakansal390@gmail.com>]

On 9/23/26 6:16 PM, Aaditya Kansal wrote:
> syzbot reported array-index-out-of-bounds in super_90_sync()
>      UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17
>      index 124 is out of range for type 'mdp_disk_t [27]'
>      CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G    L
>      syzkaller #0 PREEMPT(full)
>      Tainted: [L]=SOFTLOCKUP
>      Hardware name: Google Google Compute Engine/Google Compute Engine,
>      BIOS Google 08/05/2026
>      Call Trace:
>       <TASK>
>       __dump_stack lib/dump_stack.c:94 [inline]
>       dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
>       ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
>       __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
>       super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697
>   ...
>
> super_90_sync() exists for older version 0.90, which supports up to 27
> maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks
> for raid disks. The repro wrote higher value (124) in raid_disks sysfs
> attribute to trigger this bug.
>
> The repro is one configuration that triggers this bug, which is caused by
> the lack of proper checks at sysfs stores. Store is one path to reach
> OOB.
>
> Add helper function md_check_disks_fit_metadata() and call it at
> raid_disks_store() and metadata_store() to reject the write for
> mismatched configuration (raid_disks > MD_SB_DISKS for major == 0). This
> prevents invalid configuration via stores from reaching the super_90_sync
> function.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9e3014263a35700ab49b
> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
> ---
> v2:
> - moved the fix from super_90_sync() to a level above at store functions
> - add checks at stores themselves to prevent wrong configuration from
>    reaching the target function
> - add helper function to be called at all the sites where check is
>    required
>
>   drivers/md/md.c | 23 ++++++++++++++++++++++-
>   1 file changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 680b34a63cb3..f0f693f6bf7c 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1354,6 +1354,13 @@ int md_check_no_bitmap(struct mddev *mddev)
>   }
>   EXPORT_SYMBOL(md_check_no_bitmap);
>
> +static int md_check_disks_fit_metadata(int major, int raid_disks)
> +{
> +	if (major == 0 && raid_disks > MD_SB_DISKS)
> +		return -EINVAL;
> +	return 0;
> +}
> +
>   /*
>    * load_super for 0.90.0
>    */
> @@ -4448,8 +4455,15 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
>   		mddev->delta_disks = n - olddisks;
>   		mddev->raid_disks = n;
>   		mddev->reshape_backwards = (mddev->delta_disks < 0);
> -	} else
> +	} else {
> +		err = md_check_disks_fit_metadata(mddev->major_version, n);
> +		if (err) {
> +			pr_warn("md: raid disks (%d) exceeds max disks (%d) for metadata version 0.90",
> +					n, MD_SB_DISKS);
> +			goto out_unlock;
> +		}
>   		mddev->raid_disks = n;
> +	}
>   out_unlock:
>   	memalloc_noio_restore(noio_flags);
>   	mddev_unlock_and_resume(mddev);
> @@ -5041,6 +5055,13 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len)
>   	err = -ENOENT;
>   	if (major >= ARRAY_SIZE(super_types) || super_types[major].name == NULL)
>   		goto out_unlock;
> +
> +	err = md_check_disks_fit_metadata(major, mddev->raid_disks);
> +	if (err) {
> +		pr_warn("md: metadata version 0.90 doesn't support raid disks count higher than %d",
> +				MD_SB_DISKS);
> +		goto out_unlock;
> +	}
>   	mddev->major_version = major;
>   	mddev->minor_version = minor;
>   	mddev->persistent = 1;
> --
> 2.55.0

Hi, ping for the patch.

-AK