Re: [PATCH] md/raid5: don't BUG() on an inconsistent reshape state from the superblock

[yu kuai]

在 2026/9/10 21:11, Yogesh Gaur 写道:

> raid5_run() branches on mddev->reshape_position. When it is MaxSector --
>
> no reshape in progress -- the else branch asserts that nothing else
>
> describes one:
>
>
>
> 	BUG_ON(mddev->level != mddev->new_level);
>
> 	BUG_ON(mddev->layout != mddev->new_layout);
>
> 	BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);
>
> 	BUG_ON(mddev->delta_disks != 0);
>
>
>
> Nothing enforces that invariant. Both superblock validators copy the
>
> reshape fields straight off disk without cross-checking them against
>
> each other: super_1_validate() takes reshape_position, delta_disks,
>
> new_level, new_layout and new_chunk from the superblock whenever
>
> MD_FEATURE_RESHAPE_ACTIVE is set, and super_90_validate() does the same
>
> for minor version 91. A superblock that sets the reshape feature while
>
> leaving reshape_position at the MaxSector sentinel therefore reaches the
>
> else branch with a non-zero delta_disks, and assembling the array takes
>
> the machine down:
>
>
>
>    kernel BUG at drivers/md/raid5.c:8117!
>
>    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
>
>    RIP: 0010:raid5_run+0x11a7/0x1670 drivers/md/raid5.c:8117
>
>    Call Trace:
>
>     md_run+0xc2f/0x2510 drivers/md/md.c:6779
>
>     do_md_run+0x36/0x660 drivers/md/md.c:6880
>
>     array_state_store+0x9c5/0xcf0 drivers/md/md.c:4765
>
>     md_attr_store+0x1c5/0x330 drivers/md/md.c:6158
>
>     sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>
>     kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>
>
>
> This is reachable by anyone who can present an md superblock, so BUG()
>
> is the wrong response. Refuse to start the array instead, the way the
>
> reshape_position != MaxSector branch a few lines above already refuses a
>
> reshape it cannot resume. Nothing has been allocated at this point --
>
> the journal-and-bitmap check just above returns -EINVAL the same way --
>
> so there is nothing to unwind.
>
>
>
> Reported-by:syzbot+1f5a7de91d547763f4c8@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> Closes:https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8
>
> Fixes: 91adb56473fe ("md/raid5: refactor raid5 "run"")
>
> Assisted-by: LLM
>
> Signed-off-by: Yogesh Gaur<yogeshgaur.83@xxxxxxxxx>
>
> ---
>
>   drivers/md/raid5.c | 16 +++++++++++-----
>
>   1 file changed, 11 insertions(+), 5 deletions(-)
Applied to md-7.3

-- 
Thanks,
Kuai