| Message ID | tencent_E2C71605D88087940237AA9A44CC8D436D06@qq.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | md: fix potential OOB in multipath_remove_disk() | expand |
On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote: > If rddev->raid_disk is greater than mddev->raid_disks, there will be > an out-of-bounds in multipath_remove_disk. We have already found > similar reports as follows: > > 1) commit d17f744e883b ("md-raid10: fix KASAN warning") > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk") > > Fix this bug by checking whether the "number" variable is > valid. I think it might just be time to finally dropped the deprecated md multipath code instead..
在 2023年7月13日星期四 CST 上午12:50:19，Christoph Hellwig 写道： > On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote: > > If rddev->raid_disk is greater than mddev->raid_disks, there will be > > an out-of-bounds in multipath_remove_disk. We have already found > > similar reports as follows: > > > > 1) commit d17f744e883b ("md-raid10: fix KASAN warning") > > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk") > > > > Fix this bug by checking whether the "number" variable is > > valid. > > I think it might just be time to finally dropped the deprecated md > multipath code instead.. Should I write another patch to delete them?
On Sat, Jul 15, 2023 at 5:45 PM Zhang Shurong <zhang_shurong@foxmail.com> wrote: > > 在 2023年7月13日星期四 CST 上午12:50:19，Christoph Hellwig 写道： > > On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote: > > > If rddev->raid_disk is greater than mddev->raid_disks, there will be > > > an out-of-bounds in multipath_remove_disk. We have already found > > > similar reports as follows: > > > > > > 1) commit d17f744e883b ("md-raid10: fix KASAN warning") > > > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk") > > > > > > Fix this bug by checking whether the "number" variable is > > > valid. > > > > I think it might just be time to finally dropped the deprecated md > > multipath code instead.. > Should I write another patch to delete them? Yes, please write a patch to delete the multipath code. Thanks, Song
Dear Song, Zhang and Christoph, Am 29.07.23 um 12:46 schrieb Song Liu: > On Sat, Jul 15, 2023 at 5:45 PM Zhang Shurong wrote: >> >> 在 2023年7月13日星期四 CST 上午12:50:19，Christoph Hellwig 写道： >>> On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote: >>>> If rddev->raid_disk is greater than mddev->raid_disks, there will be >>>> an out-of-bounds in multipath_remove_disk. We have already found >>>> similar reports as follows: >>>> >>>> 1) commit d17f744e883b ("md-raid10: fix KASAN warning") >>>> 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk") >>>> >>>> Fix this bug by checking whether the "number" variable is >>>> valid. >>> >>> I think it might just be time to finally dropped the deprecated md >>> multipath code instead.. >> Should I write another patch to delete them? > > Yes, please write a patch to delete the multipath code. How would fixing this bug work with the stable series? Probably a removal patch wouldn’t be picked, right? Shouldn’t the fix be accepted in master, and then the code be removed? Kind regards, Paul
diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c index 92c45be203d7..7b6aadd8c1fb 100644 --- a/drivers/md/md-multipath.c +++ b/drivers/md/md-multipath.c @@ -245,7 +245,11 @@ static int multipath_remove_disk(struct mddev *mddev, struct md_rdev *rdev) struct mpconf *conf = mddev->private; int err = 0; int number = rdev->raid_disk; - struct multipath_info *p = conf->multipaths + number; + struct multipath_info *p; + + if (unlikely(number >= mddev->raid_disks)) + return 0; + p = conf->multipaths + number; print_multipath_conf(conf);
If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in multipath_remove_disk. We have already found similar reports as follows: 1) commit d17f744e883b ("md-raid10: fix KASAN warning") 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk") Fix this bug by checking whether the "number" variable is valid. Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> --- drivers/md/md-multipath.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)