This is a note to let you know that I've just added the patch titled md: make sure desc_nr less than MD_SB_DISKS to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: md-make-sure-desc_nr-less-than-md_sb_disks.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit ae820f97a4418e5dc6b9be02c71b8001375fa2d9 Author: Yufen Yu <yuyufen@xxxxxxxxxx> Date: Tue Dec 10 15:01:29 2019 +0800 md: make sure desc_nr less than MD_SB_DISKS [ Upstream commit 3b7436cc9449d5ff7fa1c1fd5bc3edb6402ff5b8 ] For super_90_load, we need to make sure 'desc_nr' less than MD_SB_DISKS, avoiding invalid memory access of 'sb->disks'. Fixes: 228fc7d76db6 ("md: avoid invalid memory access for array sb->dev_roles") Signed-off-by: Yufen Yu <yuyufen@xxxxxxxxxx> Signed-off-by: Song Liu <songliubraving@xxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/md/md.c b/drivers/md/md.c index 805b33e27496..4e7c9f398bc6 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1159,6 +1159,7 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor /* not spare disk, or LEVEL_MULTIPATH */ if (sb->level == LEVEL_MULTIPATH || (rdev->desc_nr >= 0 && + rdev->desc_nr < MD_SB_DISKS && sb->disks[rdev->desc_nr].state & ((1<<MD_DISK_SYNC) | (1 << MD_DISK_ACTIVE)))) spare_disk = false;