Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in super_90_sync

[syzbot <syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] UBSAN: array-index-out-of-bounds in super_90_sync
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2f0c1cf72f4682178506f513bbf015e591b1aa4a

Reported-by: syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63..1f84f2034 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1393,7 +1393,12 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
 		goto abort;
 	}
 
-	if (sb->raid_disks <= 0)
+	/*
+	 * The 0.90 superblock only has room for MD_SB_DISKS disk
+	 * descriptors; a larger raid_disks would later make
+	 * super_90_sync() index beyond the end of sb->disks[].
+	 */
+	if (sb->raid_disks <= 0 || sb->raid_disks > MD_SB_DISKS)
 		goto abort;
 
 	if (md_csum_fold(calc_sb_csum(sb)) != md_csum_fold(sb->sb_csum)) {
@@ -7926,6 +7931,16 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info)
 		mddev->ctime         = ktime_get_real_seconds();
 		return 0;
 	}
+	/*
+	 * A persistent (0.90) superblock can only describe MD_SB_DISKS
+	 * devices.  Reject negative or oversized raid_disks here so that
+	 * super_90_sync() cannot index outside sb->disks[].
+	 * Non-persistent arrays never write a superblock, so they are not
+	 * limited by this on-disk format.
+	 */
+	if (info->raid_disks < 0 ||
+	    (!info->not_persistent && info->raid_disks > MD_SB_DISKS))
+		return -EINVAL;
 	mddev->major_version = MD_MAJOR_VERSION;
 	mddev->minor_version = MD_MINOR_VERSION;
 	mddev->patch_version = MD_PATCHLEVEL_VERSION;