Re: [PATCH] md/raid5: don't BUG() on an inconsistent reshape state from the superblock

[Yogesh Gaur]

On Sat, Sep 12, 2026 at 1:18 PM yu kuai <yukuai@xxxxxxx> wrote:
>
> 在 2026/9/10 21:11, Yogesh Gaur 写道:
>
> > raid5_run() branches on mddev->reshape_position. When it is MaxSector --
> >
> > no reshape in progress -- the else branch asserts that nothing else
> >
> > describes one:
> >
> >
> >
> >       BUG_ON(mddev->level != mddev->new_level);
> >
> >       BUG_ON(mddev->layout != mddev->new_layout);
> >
> >       BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);
> >
> >       BUG_ON(mddev->delta_disks != 0);
> >
> >
> >
> > Nothing enforces that invariant. Both superblock validators copy the
> >
> > reshape fields straight off disk without cross-checking them against
> >
> > each other: super_1_validate() takes reshape_position, delta_disks,
> >
> > new_level, new_layout and new_chunk from the superblock whenever
> >
> > MD_FEATURE_RESHAPE_ACTIVE is set, and super_90_validate() does the same
> >
> > for minor version 91. A superblock that sets the reshape feature while
> >
> > leaving reshape_position at the MaxSector sentinel therefore reaches the
> >
> > else branch with a non-zero delta_disks, and assembling the array takes
> >
> > the machine down:
> >
> >
> >
> >    kernel BUG at drivers/md/raid5.c:8117!
> >
> >    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
> >
> >    RIP: 0010:raid5_run+0x11a7/0x1670 drivers/md/raid5.c:8117
> >
> >    Call Trace:
> >
> >     md_run+0xc2f/0x2510 drivers/md/md.c:6779
> >
> >     do_md_run+0x36/0x660 drivers/md/md.c:6880
> >
> >     array_state_store+0x9c5/0xcf0 drivers/md/md.c:4765
> >
> >     md_attr_store+0x1c5/0x330 drivers/md/md.c:6158
> >
> >     sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> >
> >     kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> >
> >
> >
> > This is reachable by anyone who can present an md superblock, so BUG()
> >
> > is the wrong response. Refuse to start the array instead, the way the
> >
> > reshape_position != MaxSector branch a few lines above already refuses a
> >
> > reshape it cannot resume. Nothing has been allocated at this point --
> >
> > the journal-and-bitmap check just above returns -EINVAL the same way --
> >
> > so there is nothing to unwind.
> >
> >
> >
> > Reported-by:syzbot+1f5a7de91d547763f4c8@xxxxxxxxxxxxxxxxxxxxxxxxx
> >
> > Closes:https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8
> >
> > Fixes: 91adb56473fe ("md/raid5: refactor raid5 "run"")
> >
> > Assisted-by: LLM
> >
> > Signed-off-by: Yogesh Gaur<yogeshgaur.83@xxxxxxxxx>
> >
> > ---
> >
> >   drivers/md/raid5.c | 16 +++++++++++-----
> >
> >   1 file changed, 11 insertions(+), 5 deletions(-)
> Applied to md-7.3
>
Thanks.

> --
> Thanks,
> Kuai