Forwarded: [PATCH] UBSAN: array-index-out-of-bounds in super_90_sync

[syzbot <syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] UBSAN: array-index-out-of-bounds in super_90_sync
Author: jchuang26@m.fudan.edu.cn

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Reported-by: syzbot+9e3014263a35700ab49b@syzkaller.appspotmail.com

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63..45fcf79b2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1393,7 +1393,12 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
 		goto abort;
 	}
 
-	if (sb->raid_disks <= 0)
+	/*
+	 * A 0.90 superblock has only MD_SB_DISKS descriptors, and
+	 * super_90_sync() uses raid_disks as the first free spare slot.
+	 * Reject geometries which cannot be represented safely.
+	 */
+	if (sb->raid_disks <= 0 || sb->raid_disks >= MD_SB_DISKS)
 		goto abort;
 
 	if (md_csum_fold(calc_sb_csum(sb)) != md_csum_fold(sb->sb_csum)) {
@@ -1408,6 +1413,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor
 	rdev->badblocks.shift = -1;
 
 	rdev->desc_nr = sb->this_disk.number;
+	/* desc_nr is used as an index into sb->disks[] below and later. */
+	if (rdev->desc_nr < 0 || rdev->desc_nr >= MD_SB_DISKS)
+		goto abort;
 
 	/* not spare disk */
 	if (rdev->desc_nr >= 0 && rdev->desc_nr < MD_SB_DISKS &&
@@ -1487,6 +1495,13 @@ static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, stru
 	clear_bit(Bitmap_sync, &rdev->flags);
 	clear_bit(WriteMostly, &rdev->flags);
 
+	/* rdev->desc_nr is used to index sb->disks[] below. */
+	if (rdev->desc_nr < 0 || rdev->desc_nr >= MD_SB_DISKS) {
+		pr_warn("md: invalid disk number %d on %pg\n",
+			rdev->desc_nr, rdev->bdev);
+		return -EINVAL;
+	}
+
 	if (mddev->raid_disks == 0) {
 		mddev->major_version = 0;
 		mddev->minor_version = sb->minor_version;
@@ -1575,6 +1590,14 @@ static int super_90_validate(struct mddev *mddev, struct md_rdev *freshest, stru
 
 	desc = sb->disks + rdev->desc_nr;
 
+	/* An active descriptor must not point past sb->disks[]. */
+	if ((desc->state & ((1<<MD_DISK_SYNC) | (1<<MD_DISK_ACTIVE))) &&
+	    desc->raid_disk >= MD_SB_DISKS) {
+		pr_warn("md: invalid raid_disk %u on %pg\n",
+			desc->raid_disk, rdev->bdev);
+		return -EINVAL;
+	}
+
 	if (desc->state & (1<<MD_DISK_FAULTY))
 		set_bit(Faulty, &rdev->flags);
 	else if (desc->state & (1<<MD_DISK_SYNC)) {
@@ -1620,6 +1643,17 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev)
 	int i;
 	int active=0, working=0,failed=0,spare=0,nr_disks=0;
 
+	/*
+	 * A 0.90 superblock has only MD_SB_DISKS descriptors and needs one
+	 * free slot for spares/faulty disks.  Refuse invalid geometry rather
+	 * than indexing sb->disks[] out of bounds.
+	 */
+	if (mddev->raid_disks < 0 || mddev->raid_disks >= MD_SB_DISKS) {
+		pr_warn("md: %s: invalid number of raid disks %d\n",
+			mdname(mddev), mddev->raid_disks);
+		return;
+	}
+
 	rdev->sb_size = MD_SB_BYTES;
 
 	sb = page_address(rdev->sb_page);
@@ -1693,6 +1727,12 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev)
 			desc_nr = rdev2->raid_disk;
 		else
 			desc_nr = next_spare++;
+		/* The slot number must fit in the on-disk descriptor array. */
+		if (desc_nr < 0 || desc_nr >= MD_SB_DISKS) {
+			pr_warn("md: %s: invalid disk descriptor %d\n",
+				mdname(mddev), desc_nr);
+			return;
+		}
 		rdev2->desc_nr = desc_nr;
 		d = &sb->disks[rdev2->desc_nr];
 		nr_disks++;
@@ -4428,6 +4468,20 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len)
 	if (err)
 		return err;
 	noio_flags = memalloc_noio_save();
+	/*
+	 * Make sure the new value fits in the selected metadata format.
+	 * A 0.90 superblock has only MD_SB_DISKS descriptors, and
+	 * super_90_sync() uses raid_disks as the first free spare slot.
+	 */
+	if (mddev->max_disks && n >= mddev->max_disks) {
+		err = -EINVAL;
+		goto out_unlock;
+	}
+	if (mddev->persistent && mddev->major_version == 0 &&
+	    n >= MD_SB_DISKS) {
+		err = -EINVAL;
+		goto out_unlock;
+	}
 	if (mddev->pers) {
 		if (n != mddev->raid_disks)
 			err = update_raid_disks(mddev, n);
@@ -7926,6 +7980,17 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info)
 		mddev->ctime         = ktime_get_real_seconds();
 		return 0;
 	}
+	/*
+	 * A persistent 0.90 superblock has only MD_SB_DISKS descriptors, and
+	 * one must stay free for spares/faulty disks.  A larger raid_disks
+	 * value would make super_90_sync() index sb->disks[] out of bounds.
+	 */
+	if (info->raid_disks < 0 ||
+	    (!info->not_persistent && info->raid_disks >= MD_SB_DISKS)) {
+		pr_warn("md: invalid number of raid disks %d\n",
+			info->raid_disks);
+		return -EINVAL;
+	}
 	mddev->major_version = MD_MAJOR_VERSION;
 	mddev->minor_version = MD_MINOR_VERSION;
 	mddev->patch_version = MD_PATCHLEVEL_VERSION;