In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md\/raid10: fix still_degraded being inverted in raid10_sync_request()<\/p>\n
Commit fe6a19d40ceb (“md\/md-bitmap: merge md_bitmap_start_sync() into
\nbitmap_operations”) converted still_degraded from int to bool, but
\ninverted the assignment in the loop that checks whether the array will
\nstill be degraded after the current device is recovered:
\n“still_degraded = 1” became “still_degraded = false”.<\/p>\n
As a result, recovering a device while another mirror is still missing
\ncalls md_bitmap_start_sync() with degraded == false, which clears bitmap
\nbits that the still-missing device needs. When that device is re-added,
\nits bitmap-based recovery finds the bits already cleared and skips every
\nregion written while the array was degraded, so it is marked In_sync
\nwhile holding stale data: silent corruption.<\/p>\n
Reproducer (raid10 near=2, 4 disks, internal bitmap):
\n – fail and remove one disk of each mirror pair
\n – write to the degraded array
\n – re-add both disks and let recovery finish
\n – “check” reports mismatch_cnt=262272 after 256 MiB of degraded
\n writes and file contents differ; the second disk’s “recovery”
\n completes in milliseconds because everything is skipped<\/p>\n
The same conversion in raid1 got it right (still_degraded = true).
\nRestore the correct value.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
md\/raid10: fix still_degraded being inverted in raid10_sync_request()<\/p>\n
Commit fe6a19d40ceb (“md\/md-bitmap: merge md_bitmap_start_sy<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21480","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21480","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}