Re: [PATCH 1/2] md: fix bblog_size-driven OOB read in super_1_load() and super_1_sync()

[Yuchao Zhang]

Hi Kuai,

Thanks for the review.

The 'else if (sb->bblog_offset != 0)' branch handles the valid on-disk
state where bblog space was reserved at array creation but no bad blocks
have been recorded yet (MD_FEATURE_BAD_BLOCKS clear).  A corrupted or
forged superblock - hardware fault, fuzzing, or a malicious shared disk -
can carry an oversized bblog_size (e.g. 0xFFFF) in that state, bypassing
the existing validation in the MD_FEATURE_BAD_BLOCKS branch.

When the first bad block is later recorded, super_1_sync() copies
sb->bblog_size into bb->size, and md_write_metadata() then builds a bio
larger than the backing rdev->bb_page, reading past it and leaking kernel
memory contents to disk.

You are right that fixing super_1_load() alone is sufficient: the kernel
never modifies sb->bblog_size between load and sync, and with the -EINVAL
check the device never enters the array, so super_1_sync() is never
reached with an oversized value.  v2 keeps only the super_1_load()
validation.

Thanks,
Yuchao