Re: [PATCH 2/2] md: add defensive bounds check for bio in md_write_metadata()

["yu kuai" <yukuai@fygo.io>]

Hi,

在 2026/9/17 16:38, zjamg 写道:
> md_write_metadata() allocates a single-bvec bio via bio_alloc_bioset()
> with nr_vecs = 1 and attaches a single page 'page' (either rdev->sb_page
> or rdev->bb_page) via __bio_add_page(bio, page, size, offset).
>
> Because the bio can only ever represent a single backing page, passing
> a non-positive size or a length where offset + size > PAGE_SIZE is invalid
> and can lead to out-of-bounds reads during I/O submission.
>
> Add a defensive check in md_write_metadata() so that any oversized or
> invalid request triggers WARN_ON_ONCE() and aborts before constructing
> the bio.
>
> Signed-off-by: zjamg <ndaugoing@gmail.com>
> ---
>   drivers/md/md.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index d2433cf41e65..3fda2965c631 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -1142,6 +1142,9 @@ void md_write_metadata(struct mddev *mddev, struct md_rdev *rdev,
>   	if (test_bit(Faulty, &rdev->flags))
>   		return;
>   
> +	if (WARN_ON_ONCE(size <= 0 || offset + size > PAGE_SIZE))
> +		return;

This is not a proper checking, as there is no error handler here. A better solution should
either make the rdev faulty or retry the metadata. But I don't think this is necessary, as
there isn't any path to trigger this error other than raw disk metadata inject.

> +
>   	bio = bio_alloc_bioset(rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev,
>   			      1,
>   			      REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META

-- 
Thanks,
Kuai