2023-07-12 17:34:12

by Christoph Hellwig

[permalink] [raw]
Subject: Re: [PATCH] md: fix potential OOB in multipath_remove_disk()

On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
> If rddev->raid_disk is greater than mddev->raid_disks, there will be
> an out-of-bounds in multipath_remove_disk. We have already found
> similar reports as follows:
>
> 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
> 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
>
> Fix this bug by checking whether the "number" variable is
> valid.

I think it might just be time to finally dropped the deprecated md
multipath code instead..


2023-07-15 10:43:17

by Zhang Shurong

[permalink] [raw]
Subject: Re: [PATCH] md: fix potential OOB in multipath_remove_disk()

在 2023年7月13日星期四 CST 上午12:50:19,Christoph Hellwig 写道:
> On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
> > If rddev->raid_disk is greater than mddev->raid_disks, there will be
> > an out-of-bounds in multipath_remove_disk. We have already found
> > similar reports as follows:
> >
> > 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
> > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
> >
> > Fix this bug by checking whether the "number" variable is
> > valid.
>
> I think it might just be time to finally dropped the deprecated md
> multipath code instead..
Should I write another patch to delete them?




2023-07-29 11:44:01

by Song Liu

[permalink] [raw]
Subject: Re: [PATCH] md: fix potential OOB in multipath_remove_disk()

On Sat, Jul 15, 2023 at 5:45 PM Zhang Shurong <[email protected]> wrote:
>
> 在 2023年7月13日星期四 CST 上午12:50:19,Christoph Hellwig 写道:
> > On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
> > > If rddev->raid_disk is greater than mddev->raid_disks, there will be
> > > an out-of-bounds in multipath_remove_disk. We have already found
> > > similar reports as follows:
> > >
> > > 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
> > > 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
> > >
> > > Fix this bug by checking whether the "number" variable is
> > > valid.
> >
> > I think it might just be time to finally dropped the deprecated md
> > multipath code instead..
> Should I write another patch to delete them?

Yes, please write a patch to delete the multipath code.

Thanks,
Song

2023-07-30 10:13:54

by Paul Menzel

[permalink] [raw]
Subject: Re: [PATCH] md: fix potential OOB in multipath_remove_disk()

Dear Song, Zhang and Christoph,


Am 29.07.23 um 12:46 schrieb Song Liu:
> On Sat, Jul 15, 2023 at 5:45 PM Zhang Shurong wrote:
>>
>> 在 2023年7月13日星期四 CST 上午12:50:19,Christoph Hellwig 写道:
>>> On Thu, Jul 13, 2023 at 12:46:05AM +0800, Zhang Shurong wrote:
>>>> If rddev->raid_disk is greater than mddev->raid_disks, there will be
>>>> an out-of-bounds in multipath_remove_disk. We have already found
>>>> similar reports as follows:
>>>>
>>>> 1) commit d17f744e883b ("md-raid10: fix KASAN warning")
>>>> 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
>>>>
>>>> Fix this bug by checking whether the "number" variable is
>>>> valid.
>>>
>>> I think it might just be time to finally dropped the deprecated md
>>> multipath code instead..
>> Should I write another patch to delete them?
>
> Yes, please write a patch to delete the multipath code.

How would fixing this bug work with the stable series? Probably a
removal patch wouldn’t be picked, right? Shouldn’t the fix be accepted
in master, and then the code be removed?


Kind regards,

Paul