In the Linux kernel, the following vulnerability has been resolved:
md/raid5: avoid BUG_ON() while continue reshape after reassembling
Currently, mdadm support --revert-reshape to abort the reshape while reassembling, as the test 07revert-grow. However, following BUG_ON() can be triggerred by the test:
kernel BUG at drivers/md/raid5.c:6278! invalid opcode: 0000 [#1] PREEMPT SMP PTI irq event stamp: 158985 CPU: 6 PID: 891 Comm: md0reshape Not tainted 6.9.0-03335-g7592a0b0049a #94 RIP: 0010:reshaperequest+0x3f1/0xe60 Call Trace: <TASK> raid5syncrequest+0x43d/0x550 mddosync+0xb7a/0x2110 mdthread+0x294/0x2b0 kthread+0x147/0x1c0 retfromfork+0x59/0x70 retfromforkasm+0x1a/0x30 </TASK>
Root cause is that --revert-reshape update the raid_disks from 5 to 4, while reshape position is still set, and after reassembling the array, reshape position will be read from super block, then during reshape the checking of 'writepos' that is caculated by old reshape position will fail.
Fix this panic the easy way first, by converting the BUGON() to WARNON(), and stop the reshape if checkings fail.
Noted that mdadm must fix --revert-shape as well, and probably md/raid should enhance metadata validation as well, however this means reassemble will fail and there must be user tools to fix the wrong metadata.
[
{
"signature_type": "Function",
"id": "CVE-2024-43914-132a94f9",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4811d6e5d9f4090c3e0ff9890eb24077108046ab",
"signature_version": "v1",
"digest": {
"function_hash": "105390544028097848587381362969695752085",
"length": 5897.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-24f5b272",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@305a5170dc5cf3d395bb4c4e9239bca6d0b54b49",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-333a0587",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0ff69a42a3d2d46876d0514ecf13dffc516666",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-3e046f7c",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c92f8c1c456d556f15cbf51667b385026b2e6a0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-45350955",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c384dd4f1fb3b14a2fd199360701cc163ea88705",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-5b1ac6b1",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b33c468d543f6a83de2d61f09fec74b27e19fd2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-5cb24467",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@775a9ba16c9ffe98fe54ebf14e55d5660f2bf600",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-65e6b2cf",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4811d6e5d9f4090c3e0ff9890eb24077108046ab",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-6bacd02a",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@775a9ba16c9ffe98fe54ebf14e55d5660f2bf600",
"signature_version": "v1",
"digest": {
"function_hash": "105390544028097848587381362969695752085",
"length": 5897.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-873ecfd5",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b33740c1750a39e046339ff9240e954f0156707",
"signature_version": "v1",
"digest": {
"function_hash": "105390544028097848587381362969695752085",
"length": 5897.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-87a765d6",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c92f8c1c456d556f15cbf51667b385026b2e6a0",
"signature_version": "v1",
"digest": {
"function_hash": "305068215893479647448975477860862302983",
"length": 5893.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-bd3c1c65",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b33c468d543f6a83de2d61f09fec74b27e19fd2",
"signature_version": "v1",
"digest": {
"function_hash": "305068215893479647448975477860862302983",
"length": 5893.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-43914-c968d217",
"target": {
"file": "drivers/md/raid5.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b33740c1750a39e046339ff9240e954f0156707",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"21829379529760365505425602507163892974",
"252728571319382949361123727173242904335",
"57907575093219461469638921811980093945",
"260960630951485472639304225137195536235",
"44891180623183971865798251524290642192",
"83160313805429733909706619641569850852",
"19411162686205788474755718511079584789",
"171773780075076490041519536013811107296",
"29513027810459428689711604553293174670",
"126539753988277646640382117021245048224",
"87239064682927492397067414612456568727",
"190823777952834630751391350641631705535",
"133502733892610087868881911999265099763",
"181681028308730480999422570666806727435",
"184469426941543241962628367573133826694"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-dcd14cda",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0ff69a42a3d2d46876d0514ecf13dffc516666",
"signature_version": "v1",
"digest": {
"function_hash": "167739392244392650697479699172826141712",
"length": 5851.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-df5d519e",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c384dd4f1fb3b14a2fd199360701cc163ea88705",
"signature_version": "v1",
"digest": {
"function_hash": "167739392244392650697479699172826141712",
"length": 5851.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-43914-ed70f2af",
"target": {
"file": "drivers/md/raid5.c",
"function": "reshape_request"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@305a5170dc5cf3d395bb4c4e9239bca6d0b54b49",
"signature_version": "v1",
"digest": {
"function_hash": "105390544028097848587381362969695752085",
"length": 5897.0
},
"deprecated": false
}
]