Re: [PATCH] md/raid5: don't BUG() on an inconsistent reshape state from the superblock

在 2026/9/10 21:11, Yogesh Gaur 写道:

raid5_run() branches on mddev->reshape_position. When it is MaxSector --

no reshape in progress -- the else branch asserts that nothing else

describes one:



	BUG_ON(mddev->level != mddev->new_level);

	BUG_ON(mddev->layout != mddev->new_layout);

	BUG_ON(mddev->chunk_sectors != mddev->new_chunk_sectors);

	BUG_ON(mddev->delta_disks != 0);



Nothing enforces that invariant. Both superblock validators copy the

reshape fields straight off disk without cross-checking them against

each other: super_1_validate() takes reshape_position, delta_disks,

new_level, new_layout and new_chunk from the superblock whenever

MD_FEATURE_RESHAPE_ACTIVE is set, and super_90_validate() does the same

for minor version 91. A superblock that sets the reshape feature while

leaving reshape_position at the MaxSector sentinel therefore reaches the

else branch with a non-zero delta_disks, and assembling the array takes

the machine down:



   kernel BUG at drivers/md/raid5.c:8117!

   Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI

   RIP: 0010:raid5_run+0x11a7/0x1670 drivers/md/raid5.c:8117

   Call Trace:

    md_run+0xc2f/0x2510 drivers/md/md.c:6779

    do_md_run+0x36/0x660 drivers/md/md.c:6880

    array_state_store+0x9c5/0xcf0 drivers/md/md.c:4765

    md_attr_store+0x1c5/0x330 drivers/md/md.c:6158

    sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145

    kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345



This is reachable by anyone who can present an md superblock, so BUG()

is the wrong response. Refuse to start the array instead, the way the

reshape_position != MaxSector branch a few lines above already refuses a

reshape it cannot resume. Nothing has been allocated at this point --

the journal-and-bitmap check just above returns -EINVAL the same way --

so there is nothing to unwind.



Reported-by:syzbot+1f5a7de91d547763f4c8@syzkaller.appspotmail.com

Closes:https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8

Fixes: 91adb56473fe ("md/raid5: refactor raid5 "run"")

Assisted-by: LLM

Signed-off-by: Yogesh Gaur<yogeshgaur.83@gmail.com>

---

  drivers/md/raid5.c | 16 +++++++++++-----

  1 file changed, 11 insertions(+), 5 deletions(-)

Applied to md-7.3

-- 
Thanks,
Kuai