md/raid5: don't BUG() on an inconsistent reshape state from the superblock

[PATCH] md/raid5: don't BUG() on an inconsistent reshape state from the superblock

Posted by Yogesh Gaur 2 weeks, 1 day ago

raid5_run() branches on mddev->reshape_position. When it is MaxSector --
no reshape in progress -- the else branch asserts that nothing else
describes one:

	BUG_ON(mddev->level != mddev->new_level);
	BUG_ON(mddev->layout != mddev->new_layout);
	BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);
	BUG_ON(mddev->delta_disks != 0);

Nothing enforces that invariant. Both superblock validators copy the
reshape fields straight off disk without cross-checking them against
each other: super_1_validate() takes reshape_position, delta_disks,
new_level, new_layout and new_chunk from the superblock whenever
MD_FEATURE_RESHAPE_ACTIVE is set, and super_90_validate() does the same
for minor version 91. A superblock that sets the reshape feature while
leaving reshape_position at the MaxSector sentinel therefore reaches the
else branch with a non-zero delta_disks, and assembling the array takes
the machine down:

  kernel BUG at drivers/md/raid5.c:8117!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:raid5_run+0x11a7/0x1670 drivers/md/raid5.c:8117
  Call Trace:
   md_run+0xc2f/0x2510 drivers/md/md.c:6779
   do_md_run+0x36/0x660 drivers/md/md.c:6880
   array_state_store+0x9c5/0xcf0 drivers/md/md.c:4765
   md_attr_store+0x1c5/0x330 drivers/md/md.c:6158
   sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
   kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345

This is reachable by anyone who can present an md superblock, so BUG()
is the wrong response. Refuse to start the array instead, the way the
reshape_position != MaxSector branch a few lines above already refuses a
reshape it cannot resume. Nothing has been allocated at this point --
the journal-and-bitmap check just above returns -EINVAL the same way --
so there is nothing to unwind.

Reported-by: syzbot+1f5a7de91d547763f4c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8
Fixes: 91adb56473fe ("md/raid5: refactor raid5 "run"")
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
---
 drivers/md/raid5.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b91545ce090d..682812277ce5 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -8110,11 +8110,17 @@ static int raid5_run(struct mddev *mddev)
 		}
 		pr_debug("md/raid:%s: reshape will continue\n", mdname(mddev));
 		/* OK, we should be able to continue; */
-	} else {
-		BUG_ON(mddev->level != mddev->new_level);
-		BUG_ON(mddev->layout != mddev->new_layout);
-		BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);
-		BUG_ON(mddev->delta_disks != 0);
+	} else if (mddev->level != mddev->new_level ||
+		   mddev->layout != mddev->new_layout ||
+		   mddev->chunk_sectors != mddev->new_chunk_sectors ||
+		   mddev->delta_disks != 0) {
+		/* No reshape is in progress, but the array describes one.
+		 * The superblock validators do not cross-check these against
+		 * reshape_position, so this is reachable from disk.
+		 */
+		pr_warn("md/raid:%s: inconsistent reshape state - aborting.\n",
+			mdname(mddev));
+		return -EINVAL;
 	}
 
 	if (test_bit(MD_HAS_JOURNAL, &mddev->flags) &&
-- 
2.34.1

Re: [PATCH] md/raid5: don't BUG() on an inconsistent reshape state from the superblock

Posted by yu kuai 1 week, 6 days ago

在 2026/9/10 21:11, Yogesh Gaur 写道:

> raid5_run() branches on mddev->reshape_position. When it is MaxSector --
>
> no reshape in progress -- the else branch asserts that nothing else
>
> describes one:
>
>
>
> 	BUG_ON(mddev->level != mddev->new_level);
>
> 	BUG_ON(mddev->layout != mddev->new_layout);
>
> 	BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);
>
> 	BUG_ON(mddev->delta_disks != 0);
>
>
>
> Nothing enforces that invariant. Both superblock validators copy the
>
> reshape fields straight off disk without cross-checking them against
>
> each other: super_1_validate() takes reshape_position, delta_disks,
>
> new_level, new_layout and new_chunk from the superblock whenever
>
> MD_FEATURE_RESHAPE_ACTIVE is set, and super_90_validate() does the same
>
> for minor version 91. A superblock that sets the reshape feature while
>
> leaving reshape_position at the MaxSector sentinel therefore reaches the
>
> else branch with a non-zero delta_disks, and assembling the array takes
>
> the machine down:
>
>
>
>    kernel BUG at drivers/md/raid5.c:8117!
>
>    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
>
>    RIP: 0010:raid5_run+0x11a7/0x1670 drivers/md/raid5.c:8117
>
>    Call Trace:
>
>     md_run+0xc2f/0x2510 drivers/md/md.c:6779
>
>     do_md_run+0x36/0x660 drivers/md/md.c:6880
>
>     array_state_store+0x9c5/0xcf0 drivers/md/md.c:4765
>
>     md_attr_store+0x1c5/0x330 drivers/md/md.c:6158
>
>     sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
>
>     kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
>
>
>
> This is reachable by anyone who can present an md superblock, so BUG()
>
> is the wrong response. Refuse to start the array instead, the way the
>
> reshape_position != MaxSector branch a few lines above already refuses a
>
> reshape it cannot resume. Nothing has been allocated at this point --
>
> the journal-and-bitmap check just above returns -EINVAL the same way --
>
> so there is nothing to unwind.
>
>
>
> Reported-by:syzbot+1f5a7de91d547763f4c8@syzkaller.appspotmail.com
>
> Closes:https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8
>
> Fixes: 91adb56473fe ("md/raid5: refactor raid5 "run"")
>
> Assisted-by: LLM
>
> Signed-off-by: Yogesh Gaur<yogeshgaur.83@gmail.com>
>
> ---
>
>   drivers/md/raid5.c | 16 +++++++++++-----
>
>   1 file changed, 11 insertions(+), 5 deletions(-)
Applied to md-7.3

-- 
Thanks,
Kuai

Re: [PATCH] md/raid5: don't BUG() on an inconsistent reshape state from the superblock

Posted by Yogesh Gaur 1 week, 4 days ago

On Sat, Sep 12, 2026 at 1:18 PM yu kuai <yukuai@fygo.io> wrote:
>
> 在 2026/9/10 21:11, Yogesh Gaur 写道:
>
> > raid5_run() branches on mddev->reshape_position. When it is MaxSector --
> >
> > no reshape in progress -- the else branch asserts that nothing else
> >
> > describes one:
> >
> >
> >
> >       BUG_ON(mddev->level != mddev->new_level);
> >
> >       BUG_ON(mddev->layout != mddev->new_layout);
> >
> >       BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);
> >
> >       BUG_ON(mddev->delta_disks != 0);
> >
> >
> >
> > Nothing enforces that invariant. Both superblock validators copy the
> >
> > reshape fields straight off disk without cross-checking them against
> >
> > each other: super_1_validate() takes reshape_position, delta_disks,
> >
> > new_level, new_layout and new_chunk from the superblock whenever
> >
> > MD_FEATURE_RESHAPE_ACTIVE is set, and super_90_validate() does the same
> >
> > for minor version 91. A superblock that sets the reshape feature while
> >
> > leaving reshape_position at the MaxSector sentinel therefore reaches the
> >
> > else branch with a non-zero delta_disks, and assembling the array takes
> >
> > the machine down:
> >
> >
> >
> >    kernel BUG at drivers/md/raid5.c:8117!
> >
> >    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
> >
> >    RIP: 0010:raid5_run+0x11a7/0x1670 drivers/md/raid5.c:8117
> >
> >    Call Trace:
> >
> >     md_run+0xc2f/0x2510 drivers/md/md.c:6779
> >
> >     do_md_run+0x36/0x660 drivers/md/md.c:6880
> >
> >     array_state_store+0x9c5/0xcf0 drivers/md/md.c:4765
> >
> >     md_attr_store+0x1c5/0x330 drivers/md/md.c:6158
> >
> >     sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
> >
> >     kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
> >
> >
> >
> > This is reachable by anyone who can present an md superblock, so BUG()
> >
> > is the wrong response. Refuse to start the array instead, the way the
> >
> > reshape_position != MaxSector branch a few lines above already refuses a
> >
> > reshape it cannot resume. Nothing has been allocated at this point --
> >
> > the journal-and-bitmap check just above returns -EINVAL the same way --
> >
> > so there is nothing to unwind.
> >
> >
> >
> > Reported-by:syzbot+1f5a7de91d547763f4c8@syzkaller.appspotmail.com
> >
> > Closes:https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8
> >
> > Fixes: 91adb56473fe ("md/raid5: refactor raid5 "run"")
> >
> > Assisted-by: LLM
> >
> > Signed-off-by: Yogesh Gaur<yogeshgaur.83@gmail.com>
> >
> > ---
> >
> >   drivers/md/raid5.c | 16 +++++++++++-----
> >
> >   1 file changed, 11 insertions(+), 5 deletions(-)
> Applied to md-7.3
>
Thanks.

> --
> Thanks,
> Kuai