Linux Kernel MD RAID5 Bitmap Sector Division Logic Fix Analysis

漏洞概述 漏洞类型：RAID5 位图（bitmap）扇区除法错误（round bitmap sectors with sector division） 问题描述： 将数组数据对齐到完整 RAID5 条带宽度，导致转换时扇区数被数据块数量乘以 2 倍，而非除以 2 倍。 复现场景：4 磁盘 RAID5、1024 扇区条带、3 个数据块。完整条带为 3072 扇区；单扇区条带为 3072 扇区。正确舍入应给出 ，而旧逻辑给出 ，映射到 。 影响范围：确定性映射器测试报告修复后的组件范围为 ，旧 RAID5 范围为 。 修复方案：修复 中的除法逻辑，确保扇区数正确除以 2 而非乘以 2。 POC / 利用代码 ```c static void raids_bitmap_sector(struct mddev mddev, sector_t offset, sector_t start, sector_t *end) { sector_t per_chunk = conf->chunk_sectors; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degraded; sector_t per_chunk = conf->max_degr

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel MD RAID5 Bitmap Sector Division Logic Fix Analysis

More from this source