Re: [PATCH] md: add max_disks bound check in older version

[syzbot <syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com>]

> #syz test

"" does not look like a valid git branch or commit.

>
> syzbot reported array-index-out-of-bounds in super_90_sync()
>     UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17
>     index 124 is out of range for type 'mdp_disk_t [27]'
>     CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G    L
>     syzkaller #0 PREEMPT(full)
>     Tainted: [L]=SOFTLOCKUP
>     Hardware name: Google Google Compute Engine/Google Compute Engine,
>     BIOS Google 08/05/2026
>     Call Trace:
>      <TASK>
>      __dump_stack lib/dump_stack.c:94 [inline]
>      dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
>      ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
>      __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
>      super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697
>  ...
>
> super_90_sync() exists for older version 0.90, which supports up to 27
> maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks for
> raid disks. The repro wrote higher value (124) in raid_disks sysfs attribute
> to trigger this bug.
>
> Add bound checks in super_90_sync() to prevent index-out-of-bounds error. This
> bound check hardens super_90_sync() function, such that it can catch max disk
> index-out-of-bounds coming from any path, including raid_disks
> attribute.
>
> Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
> ---
>  drivers/md/md.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 680b34a63cb3..f5fce41637f1 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1693,6 +1693,12 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev)
>  			desc_nr = rdev2->raid_disk;
>  		else
>  			desc_nr = next_spare++;
> +
> +		if (desc_nr >= MD_SB_DISKS) {
> +			pr_warn("md: raid_disks = %d exceeds max_disks = %d for version 0.90\n",
> +					desc_nr, MD_SB_DISKS);
> +			continue;
> +		}
>  		rdev2->desc_nr = desc_nr;
>  		d = &sb->disks[rdev2->desc_nr];
>  		nr_disks++;
> @@ -1722,7 +1728,7 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev)
>  			d->state |= (1<<MD_DISK_FAILFAST);
>  	}
>  	/* now set the "removed" and "faulty" bits on any missing devices */
> -	for (i=0 ; i < mddev->raid_disks ; i++) {
> +	for (i = 0; i < mddev->raid_disks && i < MD_SB_DISKS; i++) {
>  		mdp_disk_t *d = &sb->disks[i];
>  		if (d->state == 0 && d->number == 0) {
>  			d->number = i;
> --
> 2.55.0
>