Re: [PATCH] md/raid5: reject raid4/5 with fewer than 2 devices

[Zizhi Wo]

在 2026/10/13 17:25, Zizhi Wo 写道:
> From: Zizhi Wo <wozizhi@xxxxxxxxxx>
>
> A raid4/5 array assembled with a single device has data_disks == 0, which
> is then used throughout the mapping math:
>   1) as a divisor in raid5_compute_sector() (division-by-zero splat);
>   2) as a multiplier in roundup_pow_of_two(data_disks * ...) in
>      raid5_set_limits(), which makes roundup_pow_of_two(0) shift by 64,
>      yielding a shift-out-of-bounds splat.
>   ......
>
> I reproduced this issue in my environment as well:
>
> [  294.891435] UBSAN: shift-out-of-bounds in include/linux/log2.h:57:13
> [  294.891446] shift exponent 64 is too large for 64-bit type 'long unsigned int'
> [  294.891457] CPU: 21 UID: 0 PID: 1351 Comm: sh Not tainted 7.3.0-rc7 #112 PREEMPT(full)
> [  294.891477] Call Trace:
> [  294.891481]  <TASK>
> [  294.891486]  dump_stack_lvl+0x5d/0x80
> [  294.891525]  ubsan_epilogue+0x5/0x2b
> [  294.891538]  __ubsan_handle_shift_out_of_bounds.cold+0x5e/0x113
> [  294.891568]  raid5_set_limits+0x2da/0x497
> [  294.891618]  raid5_run.cold+0x635/0xd6e
>
> setup_conf() already rejects raid6 with fewer than 4 devices; only the
> initial raid4/5 assembly path never had the check. Add it so a degenerate
> single-device raid4/5 is refused before data_disks is used.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Zizhi Wo <wozizhi@xxxxxxxxxx>
> ---
>   drivers/md/raid5.c | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
> index b91545ce090d..5a7839542e24 100644
> --- a/drivers/md/raid5.c
> +++ b/drivers/md/raid5.c
> @@ -7660,10 +7660,16 @@ static struct r5conf *setup_conf(struct mddev *mddev)
>   	if (mddev->new_level == 6 && mddev->raid_disks < 4) {
>   		pr_warn("md/raid:%s: not enough configured devices (%d, minimum 4)\n",
>   			mdname(mddev), mddev->raid_disks);
>   		return ERR_PTR(-EINVAL);
>   	}
> +	if ((mddev->new_level == 4 || mddev->new_level == 5) &&
> +	    mddev->raid_disks < 2) {
> +		pr_warn("md/raid:%s: not enough configured devices (%d, minimum 2)\n",
> +			mdname(mddev), mddev->raid_disks);
> +		return ERR_PTR(-EINVAL);
> +	}
>   
>   	if (!mddev->new_chunk_sectors ||
>   	    (mddev->new_chunk_sectors << 9) % PAGE_SIZE ||
>   	    !is_power_of_2(mddev->new_chunk_sectors)) {
>   		pr_warn("md/raid:%s: invalid chunk size %d\n",

Please ignore this patch.

I just noticed that this issue has already been fixed. Sorry for the
noise.

Thanks,
Zizhi Wo