Heming Zhao 27f672af28 md/bitmap: don't set sb values if can't pass sanity check ... [ Upstream commit e68cb83a57 ] If bitmap area contains invalid data, kernel will crash then mdadm triggers "Segmentation fault". This is cluster-md speical bug. In non-clustered env, mdadm will handle broken metadata case. In clustered array, only kernel space handles bitmap slot info. But even this bug only happened in clustered env, current sanity check is wrong, the code should be changed. How to trigger: (faulty injection) dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sda dd if=/dev/zero bs=1M count=1 oflag=direct of=/dev/sdb mdadm -C /dev/md0 -b clustered -e 1.2 -n 2 -l mirror /dev/sda /dev/sdb mdadm -Ss echo aaa > magic.txt == below modifying slot 2 bitmap data == dd if=magic.txt of=/dev/sda seek=16384 bs=1 count=3 <== destroy magic dd if=/dev/zero of=/dev/sda seek=16436 bs=1 count=4 <== ZERO chunksize mdadm -A /dev/md0 /dev/sda /dev/sdb == kernel crashes. mdadm outputs "Segmentation fault" == Reason of kernel crash: In md_bitmap_read_sb (called by md_bitmap_create), bad bitmap magic didn't block chunksize assignment, and zero value made DIV_ROUND_UP_SECTOR_T() trigger "divide error". Crash log: kernel: md: md0 stopped. kernel: md/raid1:md0: not clean -- starting background reconstruction kernel: md/raid1:md0: active with 2 out of 2 mirrors kernel: dlm: ... ... kernel: md-cluster: Joined cluster 44810aba-38bb-e6b8-daca-bc97a0b254aa slot 1 kernel: md0: invalid bitmap file superblock: bad magic kernel: md_bitmap_copy_from_slot can't get bitmap from slot 2 kernel: md-cluster: Could not gather bitmaps from slot 2 kernel: divide error: 0000 [#1] SMP NOPTI kernel: CPU: 0 PID: 1603 Comm: mdadm Not tainted 5.14.6-1-default kernel: Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] kernel: RSP: 0018:ffffc22ac0843ba0 EFLAGS: 00010246 kernel: ... ... kernel: Call Trace: kernel: ? dlm_lock_sync+0xd0/0xd0 [md_cluster 77fe..7a0] kernel: md_bitmap_copy_from_slot+0x2c/0x290 [md_mod 24ea..d3a] kernel: load_bitmaps+0xec/0x210 [md_cluster 77fe..7a0] kernel: md_bitmap_load+0x81/0x1e0 [md_mod 24ea..d3a] kernel: do_md_run+0x30/0x100 [md_mod 24ea..d3a] kernel: md_ioctl+0x1290/0x15a0 [md_mod 24ea....d3a] kernel: ? mddev_unlock+0xaa/0x130 [md_mod 24ea..d3a] kernel: ? blkdev_ioctl+0xb1/0x2b0 kernel: block_ioctl+0x3b/0x40 kernel: __x64_sys_ioctl+0x7f/0xb0 kernel: do_syscall_64+0x59/0x80 kernel: ? exit_to_user_mode_prepare+0x1ab/0x230 kernel: ? syscall_exit_to_user_mode+0x18/0x40 kernel: ? do_syscall_64+0x69/0x80 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xae kernel: RIP: 0033:0x7f4a15fa722b kernel: ... ... kernel: ---[ end trace 8afa7612f559c868 ]--- kernel: RIP: 0010:md_bitmap_create+0x1d1/0x850 [md_mod] Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Guoqing Jiang <guoqing.jiang@linux.dev> Signed-off-by: Heming Zhao <heming.zhao@suse.com> Signed-off-by: Song Liu <song@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-06-09 10:22:33 +02:00
..
bcache	bcache: fixup multiple threads crash	2022-04-08 14:23:01 +02:00
persistent-data	dm space map common: add bounds check to sm_ll_lookup_bitmap()	2022-01-27 11:04:53 +01:00
Kconfig	dm: make EBS depend on !HIGHMEM	2021-08-16 10:50:32 -06:00
Makefile	dm ima: measure data on table load	2021-08-10 13:32:40 -04:00
dm-bio-prison-v1.c	dm bio prison: replace spin_lock_irqsave with spin_lock_irq	2019-11-05 14:53:03 -05:00
dm-bio-prison-v1.h	…
dm-bio-prison-v2.c	dm bio prison v2: use true/false for bool variable	2020-01-07 12:07:08 -05:00
dm-bio-prison-v2.h	…
dm-bio-record.h	block: store a block_device pointer in struct bio	2021-01-24 18:17:20 -07:00
dm-bufio.c	dm bufio: subtract the number of initial sectors in dm_bufio_get_device_size	2021-03-04 14:53:54 -05:00
dm-builtin.c	…
dm-cache-background-tracker.c	…
dm-cache-background-tracker.h	…
dm-cache-block-types.h	…
dm-cache-metadata.c	dm: use bdev_read_only to check if a device is read-only	2021-01-24 18:15:57 -07:00
dm-cache-metadata.h	…
dm-cache-policy-internal.h	…
dm-cache-policy-smq.c	…
dm-cache-policy.c	…
dm-cache-policy.h	…
dm-cache-target.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-clone-metadata.c	dm clone metadata: remove unused function	2021-04-19 13:20:31 -04:00
dm-clone-metadata.h	dm clone metadata: Fix return type of dm_clone_nr_of_hydrated_regions()	2020-03-27 14:42:51 -04:00
dm-clone-target.c	dm clone: make array 'descs' static	2021-10-12 13:54:10 -04:00
dm-core.h	dm: interlock pending dm_io and dm_wait_for_bios_completion	2022-04-08 14:22:57 +02:00
dm-crypt.c	dm crypt: make printing of the key constant-time	2022-06-06 08:43:40 +02:00
dm-delay.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-dust.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-ebs-target.c	- Add DM infrastructure for IMA-based remote attestion. These changes	2021-08-31 14:55:09 -07:00
dm-era-target.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-exception-store.c	…
dm-exception-store.h	…
dm-flakey.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-ima.c	integrity-v5.15	2021-09-02 12:51:41 -07:00
dm-ima.h	dm ima: add version info to dm related events in ima log	2021-08-20 15:59:47 -04:00
dm-init.c	dm init: Set file local variable static	2020-08-04 15:51:28 -04:00
dm-integrity.c	dm integrity: fix error code in dm_integrity_ctr()	2022-06-06 08:43:40 +02:00
dm-io-tracker.h	dm writecache: make writeback pause configurable	2021-06-28 16:30:13 -04:00
dm-io.c	block: Add bio_max_segs	2021-02-26 15:49:51 -07:00
dm-ioctl.c	dm ioctl: prevent potential spectre v1 gadget	2022-04-13 20:59:05 +02:00
dm-kcopyd.c	dm writecache: have ssd writeback wait if the kcopyd workqueue is busy	2021-06-15 15:42:03 -04:00
dm-linear.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-log-userspace-base.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-log-userspace-transfer.c	…
dm-log-userspace-transfer.h	…
dm-log-writes.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-log.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-mpath.c	dm ima: update dm target attributes for ima measurements	2021-08-20 16:07:36 -04:00
dm-mpath.h	…
dm-path-selector.c	…
dm-path-selector.h	dm mpath: pass IO start time to path selector	2020-05-15 10:29:36 -04:00
dm-ps-historical-service-time.c	dm mpath: only use ktime_get_ns() in historical selector	2022-04-20 09:34:13 +02:00
dm-ps-io-affinity.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-ps-queue-length.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-ps-round-robin.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-ps-service-time.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-raid.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-raid1.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-region-hash.c	…
dm-rq.c	dm: requeue IO if mapping table not yet available	2022-04-13 20:59:06 +02:00
dm-rq.h	…
dm-snap-persistent.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-snap-transient.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-snap.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-stats.c	dm stats: add cond_resched when looping over entries	2022-06-06 08:43:40 +02:00
dm-stats.h	dm: fix double accounting of flush with data	2022-04-08 14:22:57 +02:00
dm-stripe.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-switch.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-sysfs.c	…
dm-table.c	libnvdimm for v5.15	2021-09-09 11:39:57 -07:00
dm-target.c	…
dm-thin-metadata.c	dm space maps: improve performance with inc/dec on ranges of blocks	2021-06-04 12:07:22 -04:00
dm-thin-metadata.h	dm thin metadata: Add support for a pre-commit callback	2019-12-05 17:05:24 -05:00
dm-thin.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-uevent.c	…
dm-uevent.h	…
dm-unstripe.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-verity-fec.c	dm verity fec: fix misaligned RS roots IO	2021-04-14 14:28:29 -04:00
dm-verity-fec.h	dm verity fec: fix misaligned RS roots IO	2021-04-14 14:28:29 -04:00
dm-verity-target.c	dm verity: set DM_TARGET_IMMUTABLE feature flag	2022-06-06 08:43:40 +02:00
dm-verity-verify-sig.c	dm verity: fix require_signatures module_param permissions	2021-05-25 16:14:05 -04:00
dm-verity-verify-sig.h	dm verity: Fix compilation warning	2020-08-04 15:48:13 -04:00
dm-verity.h	dm verity: add "panic_on_corruption" error handling mode	2020-07-13 11:47:33 -04:00
dm-writecache.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-zero.c	dm: add support for REQ_NOWAIT to various targets	2020-12-04 18:04:35 -05:00
dm-zone.c	dm zone: fix dm_revalidate_zones() memory allocation	2021-06-25 15:25:23 -04:00
dm-zoned-metadata.c	dm zoned: check zone capacity	2021-06-04 12:07:28 -04:00
dm-zoned-reclaim.c	dm kcopyd: avoid useless atomic operations	2021-06-04 12:07:24 -04:00
dm-zoned-target.c	dm: update target status functions to support IMA measurement	2021-08-10 13:34:23 -04:00
dm-zoned.h	dm zoned: select reclaim zone based on device index	2020-06-05 14:59:53 -04:00
dm.c	dm: requeue IO if mapping table not yet available	2022-04-13 20:59:06 +02:00
dm.h	dm: introduce zone append emulation	2021-06-04 12:07:37 -04:00
md-autodetect.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
md-bitmap.c	md/bitmap: don't set sb values if can't pass sanity check	2022-06-09 10:22:33 +02:00
md-bitmap.h	…
md-cluster.c	for-5.11/drivers-2020-12-14	2020-12-16 13:09:32 -08:00
md-cluster.h	…
md-faulty.c	md: mark some personalities as deprecated	2021-06-14 22:32:07 -07:00
md-linear.c	md: mark some personalities as deprecated	2021-06-14 22:32:07 -07:00
md-linear.h	md/raid1: Replace zero-length array with flexible-array	2020-05-13 12:02:23 -07:00
md-multipath.c	md: mark some personalities as deprecated	2021-06-14 22:32:07 -07:00
md-multipath.h	…
md.c	block: drop unused includes in <linux/genhd.h>	2022-03-16 14:23:46 +01:00
md.h	md: Move alloc/free acct bioset in to personality	2022-01-27 11:05:08 +01:00
raid0.c	md: Move alloc/free acct bioset in to personality	2022-01-27 11:05:08 +01:00
raid0.h	md/raid0: avoid RAID0 data corruption due to layout confusion.	2019-09-13 13:10:05 -07:00
raid1-10.c	…
raid1.c	md/raid1: fix missing bitmap update w/o WriteMostly devices	2022-01-11 15:35:15 +01:00
raid1.h	md/raid1: enable io accounting	2021-06-14 22:32:07 -07:00
raid5-cache.c	block: rename BIO_MAX_PAGES to BIO_MAX_VECS	2021-03-11 07:47:48 -07:00
raid5-log.h	…
raid5-ppl.c	block: rename BIO_MAX_PAGES to BIO_MAX_VECS	2021-03-11 07:47:48 -07:00
raid5.c	raid5: introduce MD_BROKEN	2022-06-06 08:43:40 +02:00
raid5.h	md/raid5: let multiple devices of stripe_head share page	2020-09-24 16:44:44 -07:00
raid10.c	for-5.15/drivers-2021-08-30	2021-08-30 19:01:46 -07:00
raid10.h	md/raid10: enable io accounting	2021-06-14 22:32:07 -07:00