In super_1_load(), when the on-disk feature_map does not have
MD_FEATURE_BAD_BLOCKS set but sb->bblog_offset is non-zero,
rdev->badblocks.shift is initialized to 0 without validating
sb->bblog_size.  The same field is validated in the
MD_FEATURE_BAD_BLOCKS branch ("sectors > (PAGE_SIZE / 512)"), but this
branch bypasses that check.

A forged on-disk superblock (malicious storage device or crafted
image) can therefore carry an oversized sb->bblog_size.  When bad
blocks are later recorded, super_1_sync() sets bb->size from
sb->bblog_size and md_write_metadata() issues a bio larger than the
single rdev->bb_page, reading beyond the page and leaking kernel
memory contents to disk.

sb->bblog_size is never modified by the kernel between load and sync,
and the MD_FEATURE_BAD_BLOCKS branch already validates it, so checking
it in this branch is sufficient to cover both paths.

Fix this by rejecting an oversized sb->bblog_size with -EINVAL,
matching the existing check in the MD_FEATURE_BAD_BLOCKS branch.

Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Yuchao Zhang <ndaugoing@gmail.com>
---
 drivers/md/md.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..1caa92b40f9a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1934,8 +1934,11 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
 			if (!badblocks_set(&rdev->badblocks, sector, count, 1))
 				return -EINVAL;
 		}
-	} else if (sb->bblog_offset != 0)
+	} else if (sb->bblog_offset != 0) {
+		if (le16_to_cpu(sb->bblog_size) > (PAGE_SIZE / 512))
+			return -EINVAL;
 		rdev->badblocks.shift = 0;
+	}
 
 	if ((le32_to_cpu(sb->feature_map) &
 	    (MD_FEATURE_PPL | MD_FEATURE_MULTIPLE_PPLS))) {
-- 
2.53.0

在 2026/9/22 12:46, Yuchao Zhang 写道:

> In super_1_load(), when the on-disk feature_map does not have
> MD_FEATURE_BAD_BLOCKS set but sb->bblog_offset is non-zero,
> rdev->badblocks.shift is initialized to 0 without validating
> sb->bblog_size.  The same field is validated in the
> MD_FEATURE_BAD_BLOCKS branch ("sectors > (PAGE_SIZE / 512)"), but this
> branch bypasses that check.
>
> A forged on-disk superblock (malicious storage device or crafted
> image) can therefore carry an oversized sb->bblog_size.  When bad
> blocks are later recorded, super_1_sync() sets bb->size from
> sb->bblog_size and md_write_metadata() issues a bio larger than the
> single rdev->bb_page, reading beyond the page and leaking kernel
> memory contents to disk.
>
> sb->bblog_size is never modified by the kernel between load and sync,
> and the MD_FEATURE_BAD_BLOCKS branch already validates it, so checking
> it in this branch is sufficient to cover both paths.
>
> Fix this by rejecting an oversized sb->bblog_size with -EINVAL,
> matching the existing check in the MD_FEATURE_BAD_BLOCKS branch.
>
> Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
> Cc:stable@vger.kernel.org
> Signed-off-by: Yuchao Zhang<ndaugoing@gmail.com>
> ---
>   drivers/md/md.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
Applied to md-7.4

-- 
Thanks,
Kuai