If rddev->raid_disk is greater than mddev->raid_disks, there will be
an out-of-bounds in multipath_remove_disk. We have already found
similar reports as follows:

1) commit d17f744e883b ("md-raid10: fix KASAN warning")
2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")

Fix this bug by checking whether the "number" variable is
valid.

Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
---
 drivers/md/md-multipath.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md-multipath.c b/drivers/md/md-multipath.c
index 92c45be203d7..7b6aadd8c1fb 100644
--- a/drivers/md/md-multipath.c
+++ b/drivers/md/md-multipath.c
@@ -245,7 +245,11 @@ static int multipath_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
 	struct mpconf *conf = mddev->private;
 	int err = 0;
 	int number = rdev->raid_disk;
-	struct multipath_info *p = conf->multipaths + number;
+	struct multipath_info *p;
+
+	if (unlikely(number >= mddev->raid_disks))
+		return 0;
+	p = conf->multipaths + number;
 
 	print_multipath_conf(conf);
 
-- 
2.30.2

On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
> If rddev->raid_disk is greater than mddev->raid_disks, there will be
> an out-of-bounds in multipath_remove_disk. We have already found
> similar reports as follows:
> 
> 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
> 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
> 
> Fix this bug by checking whether the "number" variable is
> valid.

I think it might just be time to finally dropped the deprecated md
multipath code instead..

在 2023年7月13日星期四 CST 上午12:50:19，Christoph Hellwig 写道：
> On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
> > If rddev->raid_disk is greater than mddev->raid_disks, there will be
> > an out-of-bounds in multipath_remove_disk. We have already found
> > similar reports as follows:
> > 
> > 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
> > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
> > 
> > Fix this bug by checking whether the "number" variable is
> > valid.
> 
> I think it might just be time to finally dropped the deprecated md
> multipath code instead..
Should I write another patch to delete them?

On Sat, Jul 15, 2023 at 5:45 PM Zhang Shurong <zhang_shurong@foxmail.com> wrote:
>
> 在 2023年7月13日星期四 CST 上午12:50:19，Christoph Hellwig 写道：
> > On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
> > > If rddev->raid_disk is greater than mddev->raid_disks, there will be
> > > an out-of-bounds in multipath_remove_disk. We have already found
> > > similar reports as follows:
> > >
> > > 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
> > > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
> > >
> > > Fix this bug by checking whether the "number" variable is
> > > valid.
> >
> > I think it might just be time to finally dropped the deprecated md
> > multipath code instead..
> Should I write another patch to delete them?

Yes, please write a patch to delete the multipath code.

Thanks,
Song

Dear Song, Zhang and Christoph,


Am 29.07.23 um 12:46 schrieb Song Liu:
> On Sat, Jul 15, 2023 at 5:45 PM Zhang Shurong wrote:
>>
>> 在 2023年7月13日星期四 CST 上午12:50:19，Christoph Hellwig 写道：
>>> On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
>>>> If rddev->raid_disk is greater than mddev->raid_disks, there will be
>>>> an out-of-bounds in multipath_remove_disk. We have already found
>>>> similar reports as follows:
>>>>
>>>> 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
>>>> 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
>>>>
>>>> Fix this bug by checking whether the "number" variable is
>>>> valid.
>>>
>>> I think it might just be time to finally dropped the deprecated md
>>> multipath code instead..
>> Should I write another patch to delete them?
> 
> Yes, please write a patch to delete the multipath code.

How would fixing this bug work with the stable series? Probably a 
removal patch wouldn’t be picked, right? Shouldn’t the fix be accepted 
in master, and then the code be removed?


Kind regards,

Paul