Forwarded: [PATCH] md: validate raid_disks against MD_SB_DISKS in super_90_load

[syzbot <syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] md: validate raid_disks against MD_SB_DISKS in super_90_load
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


The v0.90 superblock format can only describe MD_SB_DISKS (27) member
disks, but super_90_load() only checks that sb->raid_disks is
positive, not that it fits within this limit.

A crafted/corrupt superblock with an oversized raid_disks value is
accepted and copied into mddev->raid_disks. When the superblock is
later rewritten (e.g. via a write to the rdev 'state' sysfs
attribute), super_90_sync() uses this value to index sb->disks[],
causing an out-of-bounds array access:

  UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17
  index 124 is out of range for type 'mdp_disk_t [27]'

Reject superblocks whose raid_disks value cannot be represented by
the v0.90 format at load time, before it is trusted anywhere else.

Reported-by: syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9e3014263a35700ab49b
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/md/md.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..c65da77677bc 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1393,7 +1393,8 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
 		goto abort;
 	}
 
-	if (sb->raid_disks <= 0)
+	if (sb->raid_disks <= 0 ||
+            sb->raid_disks > MD_SB_DISKS)
 		goto abort;
 
 	if (md_csum_fold(calc_sb_csum(sb)) != md_csum_fold(sb->sb_csum)) {
-- 
2.34.1