DF-2497
Unbounded disk-index loop in SPAN/JBOD I/O strategy causes OOB read / hang
Summary
JBOD/SPAN branch of ata_raid_strategy walks per-disk sector table with drv++ no bound against MAX_DISKS or total_disks. If bio destination block past sum of configured per-disk sectors (trivially with crafted metadata) drv climbs past rdp->disks[16] reads/writes rdp->disks[N].sectors for N up to whatever it takes to fault leaking kernel heap and panicking. If garbage value read is 0 loop never terminates hang.
No comments yet.