Re: [PATCH] md: don't allow changing the personality of a failed array

[yu kuai]

在 2026/10/20 3:36, Sanan Hasanov 写道:

> From: Sanan Hasanov<sanan.hasanov@xxxxxxx>
>
> level_store() lets userspace switch a running array to another
> personality through the takeover path, and then ignores the return value
> of pers->run(). Takeover is expected to always produce something the new
> personality can run, but that no longer holds for an array that has
> already failed: since commit 57668f0a4cc4 ("raid5: introduce MD_BROKEN"),
> has_failed() treats MD_BROKEN as fatal, so raid5_run() refuses such an
> array. It then frees the new conf and clears mddev->private, while
> level_store() has already installed the raid5 personality and freed the
> old one. The array is left with mddev->pers == &raid5_personality and
> mddev->private == NULL, and the next operation that reaches the
> personality dereferences NULL:
>
>    md/raid0md0: Disk failure on loop0 detected, failing array.
>    md/raid:md0: not enough operational devices (1/3 failed)
>    md/raid:md0: failed to run raid set.
>    KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
>    RIP: 0010:kasan_byte_accessible+0x12/0x30 mm/kasan/generic.c:210
>    Call Trace:
>     spin_lock_irq include/linux/spinlock_rt.h:96 [inline]
>     lock_all_device_hash_locks_irq drivers/md/raid5.c:107 [inline]
>     raid5_quiesce+0xc2/0x8a0 drivers/md/raid5.c
>     __md_stop_writes+0xeb/0x4b0 drivers/md/md.c:7038
>     md_set_readonly+0x330/0x560 drivers/md/md.c:7138
>     array_state_store+0x584/0xe90 drivers/md/md.c:4720
>
> syzbot gets there by failing a member of a raid0 array, which sets
> MD_BROKEN, then writing "raid5" to md/level and "readonly" to
> md/array_state. The same applies to a two-disk raid1 array whose last
> working device has failed: raid1_error() sets MD_BROKEN but leaves
> degraded at 1, so raid5_takeover_raid1() still accepts it.
>
> MD_BROKEN is never cleared while the array is running, and a failed
> array can't be turned into a working one by changing its level. Refuse
> the change up front with -EBUSY, which is also what state_store()
> returns when failing a device leaves the array broken.
>
> Fixes: 57668f0a4cc4 ("raid5: introduce MD_BROKEN")
> Reported-by:syzbot+0b672810a475890d3636@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes:https://syzkaller.appspot.com/bug?extid=0b672810a475890d3636
> Cc:stable@xxxxxxxxxxxxxxx
> Signed-off-by: Sanan Hasanov<sanan.hasanov@xxxxxxx>
> ---
>   drivers/md/md.c | 6 ++++++
>   1 file changed, 6 insertions(+)
Applied

-- 
Thanks,
Kuai