In the Linux kernel, the following vulnerability has been resolved:
md/raid5: avoid BUG_ON() while continue reshape after reassembling
Currently, mdadm support --revert-reshape to abort the reshape while reassembling, as the test 07revert-grow. However, following BUG_ON() can be triggerred by the test:
kernel BUG at drivers/md/raid5.c:6278! invalid opcode: 0000 [#1] PREEMPT SMP PTI irq event stamp: 158985 CPU: 6 PID: 891 Comm: md0reshape Not tainted 6.9.0-03335-g7592a0b0049a #94 RIP: 0010:reshaperequest+0x3f1/0xe60 Call Trace: <TASK> raid5syncrequest+0x43d/0x550 mddosync+0xb7a/0x2110 mdthread+0x294/0x2b0 kthread+0x147/0x1c0 retfromfork+0x59/0x70 retfromforkasm+0x1a/0x30 </TASK>
Root cause is that --revert-reshape update the raid_disks from 5 to 4, while reshape position is still set, and after reassembling the array, reshape position will be read from super block, then during reshape the checking of 'writepos' that is caculated by old reshape position will fail.
Fix this panic the easy way first, by converting the BUGON() to WARNON(), and stop the reshape if checkings fail.
Noted that mdadm must fix --revert-shape as well, and probably md/raid should enhance metadata validation as well, however this means reassemble will fail and there must be user tools to fix the wrong metadata.
[
    {
        "id": "CVE-2024-43914-132a94f9",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "105390544028097848587381362969695752085",
            "length": 5897.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4811d6e5d9f4090c3e0ff9890eb24077108046ab"
    },
    {
        "id": "CVE-2024-43914-24f5b272",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@305a5170dc5cf3d395bb4c4e9239bca6d0b54b49"
    },
    {
        "id": "CVE-2024-43914-333a0587",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0ff69a42a3d2d46876d0514ecf13dffc516666"
    },
    {
        "id": "CVE-2024-43914-3e046f7c",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c92f8c1c456d556f15cbf51667b385026b2e6a0"
    },
    {
        "id": "CVE-2024-43914-45350955",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c384dd4f1fb3b14a2fd199360701cc163ea88705"
    },
    {
        "id": "CVE-2024-43914-5b1ac6b1",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b33c468d543f6a83de2d61f09fec74b27e19fd2"
    },
    {
        "id": "CVE-2024-43914-5cb24467",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@775a9ba16c9ffe98fe54ebf14e55d5660f2bf600"
    },
    {
        "id": "CVE-2024-43914-65e6b2cf",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4811d6e5d9f4090c3e0ff9890eb24077108046ab"
    },
    {
        "id": "CVE-2024-43914-6bacd02a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "105390544028097848587381362969695752085",
            "length": 5897.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@775a9ba16c9ffe98fe54ebf14e55d5660f2bf600"
    },
    {
        "id": "CVE-2024-43914-873ecfd5",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "105390544028097848587381362969695752085",
            "length": 5897.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b33740c1750a39e046339ff9240e954f0156707"
    },
    {
        "id": "CVE-2024-43914-87a765d6",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "305068215893479647448975477860862302983",
            "length": 5893.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c92f8c1c456d556f15cbf51667b385026b2e6a0"
    },
    {
        "id": "CVE-2024-43914-bd3c1c65",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "305068215893479647448975477860862302983",
            "length": 5893.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b33c468d543f6a83de2d61f09fec74b27e19fd2"
    },
    {
        "id": "CVE-2024-43914-c968d217",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/md/raid5.c"
        },
        "digest": {
            "line_hashes": [
                "21829379529760365505425602507163892974",
                "252728571319382949361123727173242904335",
                "57907575093219461469638921811980093945",
                "260960630951485472639304225137195536235",
                "44891180623183971865798251524290642192",
                "83160313805429733909706619641569850852",
                "19411162686205788474755718511079584789",
                "171773780075076490041519536013811107296",
                "29513027810459428689711604553293174670",
                "126539753988277646640382117021245048224",
                "87239064682927492397067414612456568727",
                "190823777952834630751391350641631705535",
                "133502733892610087868881911999265099763",
                "181681028308730480999422570666806727435",
                "184469426941543241962628367573133826694"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b33740c1750a39e046339ff9240e954f0156707"
    },
    {
        "id": "CVE-2024-43914-dcd14cda",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "167739392244392650697479699172826141712",
            "length": 5851.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0ff69a42a3d2d46876d0514ecf13dffc516666"
    },
    {
        "id": "CVE-2024-43914-df5d519e",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "167739392244392650697479699172826141712",
            "length": 5851.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c384dd4f1fb3b14a2fd199360701cc163ea88705"
    },
    {
        "id": "CVE-2024-43914-ed70f2af",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/md/raid5.c",
            "function": "reshape_request"
        },
        "digest": {
            "function_hash": "105390544028097848587381362969695752085",
            "length": 5897.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@305a5170dc5cf3d395bb4c4e9239bca6d0b54b49"
    }
]