[PATCH 0/2] md: fix bblog_size-driven OOB read in md_write_metadata()

[PATCH 0/2] md: fix bblog_size-driven OOB read in md_write_metadata()

[zjamg]

Hi,

This series fixes an out-of-bounds read in the md badblocks log (bblog)
write path. The on-disk bblog_size field is taken verbatim from the
member device superblock and used as the bio length in
md_write_metadata(), without any check against the size of the page that
actually backs the write.

This is a different issue from CVE-2026-89557, which fixed the
bblog_shift overflow. The bblog_size path is still unfixed.

Introduced by commit 2699b67223ac ("md: load/store badblock list from v1.x metadata").

Mechanism:

  super_1_load() reads sb->bblog_size (__le16) from the member device
  and stores it in rdev->badblocks.size via super_1_sync() (md.c:2316).
  md_update_sb() then calls

      md_write_metadata(mddev, rdev, rdev->badblocks.sector,
                        rdev->badblocks.size << 9, rdev->bb_page, 0);

  (md.c:2944-2948). bb->size is sector_t, so 0xFFFF << 9 = 33553920
  does not wrap. md_write_metadata() passes that length to
  __bio_add_page() with a single 4 KiB page:

      __bio_add_page(bio, page, size, 0)

  __bio_add_page() is the no-check variant: after a WARN_ON_ONCE() it
  unconditionally records bvec_set_page(page, size, offset) and bumps
  bi_size/bi_vcnt. bio_full()'s second clause is
  "bi_size > BIO_MAX_SIZE - len", with bi_size == 0 and
  BIO_MAX_SIZE == UINT_MAX, so it is false and not even the WARN fires.
  The 4 KiB page is recorded as a bvec with bv_len == 33553920.

Downstream bvec iteration (nth_page, bio_split_to_limits, etc.) then
reads past the end of the page, into whatever follows in the linear
map. KASAN reports slab-out-of-bounds or slab-use-after-free, and the
data is written to the attacker-controlled member device.

Reproducer (CONTROL/ATTACK, only bblog_size differs):

  CONTROL bblog_size = 8      -> 4096 bytes land, out-of-range stays
                                 at the fill pattern
  ATTACK  bblog_size = 0xFFFF -> 33553920 bytes land, KASAN reports
                                 slab-out-of-bounds in
                                 copy_folio_from_iter_atomic(), and
                                 ~33.5 MB of kernel memory is copied
                                 into the member device image

The harness creates the on-disk superblock by hand, attaches the loop
device, binds it to a new md array via sysfs, adds one bad block, and
then writes "writemostly" to the member state attribute to force an
md_update_sb(). Both runs share the same kernel, the same md module and
the same code path; the only difference is the bblog_size field in the
on-disk superblock.

Patch 1 adds an upper bound for bb->size in super_1_sync(), matching
the existing guard in super_1_load().

Patch 2 is a defensive check in md_write_metadata() itself, so that
any future caller that passes an oversized length is caught before the
bio is built. Only one of the two is strictly needed to fix the
immediate issue; I'm sending both because the checks cover different
layers.

I can send the harness and full dmesg logs if useful.

Thanks.


zjamg (2):
  md: fix bblog_size-driven OOB read in super_1_load() and
    super_1_sync()
  md: add defensive bounds check for bio in md_write_metadata()

 drivers/md/md.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/2] md: fix bblog_size-driven OOB read in super_1_load() and super_1_sync()

[zjamg]

In super_1_load(), when the on-disk feature_map does not have the
MD_FEATURE_BAD_BLOCKS flag set, but sb->bblog_offset is non-zero,
rdev->badblocks.shift is initialized to 0 while completely bypassing
the sectors > (PAGE_SIZE / 512) validation check on sb->bblog_size.

Subsequently, when badblocks are updated, super_1_sync() enables the
MD_FEATURE_BAD_BLOCKS feature flag and assigns bb->size directly from
sb->bblog_size without validating that bb->size fits within the single
allocated rdev->bb_page (which is PAGE_SIZE, or PAGE_SIZE / 512 sectors).

When md_update_sb() later writes metadata via md_write_metadata(), an
unvalidated bb->size (e.g. 0xFFFF) results in a bio whose length exceeds
the backing page, causing out-of-bounds reads into kernel memory during
block I/O and leaking kernel slab/page contents to disk.

Fix this by:
1. Validating sb->bblog_size in the 'else if (sb->bblog_offset != 0)'
   branch of super_1_load(), returning -EINVAL on oversized values.
2. Clamping bb->size in super_1_sync() to PAGE_SIZE / 512 to ensure it
   never exceeds the backing rdev->bb_page capacity.

Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Cc: stable@vger.kernel.org
Signed-off-by: zjamg <ndaugoing@gmail.com>
---
 drivers/md/md.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..d2433cf41e65 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1934,8 +1934,11 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
 			if (!badblocks_set(&rdev->badblocks, sector, count, 1))
 				return -EINVAL;
 		}
-	} else if (sb->bblog_offset != 0)
+	} else if (sb->bblog_offset != 0) {
+		if (le16_to_cpu(sb->bblog_size) > (PAGE_SIZE / 512))
+			return -EINVAL;
 		rdev->badblocks.shift = 0;
+	}
 
 	if ((le32_to_cpu(sb->feature_map) &
 	    (MD_FEATURE_PPL | MD_FEATURE_MULTIPLE_PPLS))) {
@@ -2313,7 +2316,8 @@ static void super_1_sync(struct mddev *mddev, struct md_rdev *rdev)
 
 			bb->sector = (rdev->sb_start +
 				      (int)le32_to_cpu(sb->bblog_offset));
-			bb->size = le16_to_cpu(sb->bblog_size);
+			bb->size = min_t(sector_t, le16_to_cpu(sb->bblog_size),
+					 PAGE_SIZE / 512);
 		}
 	}
 
-- 
2.53.0

[PATCH 2/2] md: add defensive bounds check for bio in md_write_metadata()

[zjamg]

md_write_metadata() allocates a single-bvec bio via bio_alloc_bioset()
with nr_vecs = 1 and attaches a single page 'page' (either rdev->sb_page
or rdev->bb_page) via __bio_add_page(bio, page, size, offset).

Because the bio can only ever represent a single backing page, passing
a non-positive size or a length where offset + size > PAGE_SIZE is invalid
and can lead to out-of-bounds reads during I/O submission.

Add a defensive check in md_write_metadata() so that any oversized or
invalid request triggers WARN_ON_ONCE() and aborts before constructing
the bio.

Signed-off-by: zjamg <ndaugoing@gmail.com>
---
 drivers/md/md.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index d2433cf41e65..3fda2965c631 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1142,6 +1142,9 @@ void md_write_metadata(struct mddev *mddev, struct md_rdev *rdev,
 	if (test_bit(Faulty, &rdev->flags))
 		return;
 
+	if (WARN_ON_ONCE(size <= 0 || offset + size > PAGE_SIZE))
+		return;
+
 	bio = bio_alloc_bioset(rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev,
 			      1,
 			      REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META
-- 
2.53.0