Patch "md: raid1: fix potential OOB in raid1_remove_disk()" has been added to the 4.19-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    md: raid1: fix potential OOB in raid1_remove_disk()

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     md-raid1-fix-potential-oob-in-raid1_remove_disk.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2943feded63c0fda4436ec45e28f4be70f2ac23f
Author: Zhang Shurong <zhang_shurong@xxxxxxxxxxx>
Date:   Sat Jul 22 15:53:53 2023 +0800

    md: raid1: fix potential OOB in raid1_remove_disk()
    
    [ Upstream commit 8b0472b50bcf0f19a5119b00a53b63579c8e1e4d ]
    
    If rddev->raid_disk is greater than mddev->raid_disks, there will be
    an out-of-bounds in raid1_remove_disk(). We have already found
    similar reports as follows:
    
    1) commit d17f744e883b ("md-raid10: fix KASAN warning")
    2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
    
    Fix this bug by checking whether the "number" variable is
    valid.
    
    Signed-off-by: Zhang Shurong <zhang_shurong@xxxxxxxxxxx>
    Reviewed-by: Yu Kuai <yukuai3@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/tencent_0D24426FAC6A21B69AC0C03CE4143A508F09@xxxxxx
    Signed-off-by: Song Liu <song@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 0f8b1fb3d0517..b459a3af94224 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1783,6 +1783,10 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
 	struct r1conf *conf = mddev->private;
 	int err = 0;
 	int number = rdev->raid_disk;
+
+	if (unlikely(number >= conf->raid_disks))
+		goto abort;
+
 	struct raid1_info *p = conf->mirrors + number;
 
 	if (rdev != p->rdev)



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux