[PATCH 2/2] md: add defensive bounds check for bio in md_write_metadata()

[zjamg <ndaugoing@gmail.com>]

md_write_metadata() allocates a single-bvec bio via bio_alloc_bioset()
with nr_vecs = 1 and attaches a single page 'page' (either rdev->sb_page
or rdev->bb_page) via __bio_add_page(bio, page, size, offset).

Because the bio can only ever represent a single backing page, passing
a non-positive size or a length where offset + size > PAGE_SIZE is invalid
and can lead to out-of-bounds reads during I/O submission.

Add a defensive check in md_write_metadata() so that any oversized or
invalid request triggers WARN_ON_ONCE() and aborts before constructing
the bio.

Signed-off-by: zjamg <ndaugoing@gmail.com>
---
 drivers/md/md.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index d2433cf41e65..3fda2965c631 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1142,6 +1142,9 @@ void md_write_metadata(struct mddev *mddev, struct md_rdev *rdev,
 	if (test_bit(Faulty, &rdev->flags))
 		return;
 
+	if (WARN_ON_ONCE(size <= 0 || offset + size > PAGE_SIZE))
+		return;
+
 	bio = bio_alloc_bioset(rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev,
 			      1,
 			      REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META
-- 
2.53.0