[PATCH] md/raid0: validate device count before allocating devlist
From: Chandradhar Kumar <hidden>
Date: 2026-09-06 14:41:00
Also in:
lkml
Subsystem:
software raid (multiple disks) support, the rest · Maintainers:
Song Liu, Yu Kuai, Linus Torvalds
create_strip_zones() allocates conf->devlist based on mddev->raid_disks before verifying that enough devices are present. Validate the number of member devices before allocating devlist to reject invalid configurations early. The existing validation later in the function already rejects this condition, but it occurs after the potentially excessive allocation. Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9 Signed-off-by: Chandradhar Kumar <redacted> --- drivers/md/raid0.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..586e3411f24c 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c@@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) sector_t curr_zone_end, sectors; struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev; struct strip_zone *zone; - int cnt; + int cnt, nr_devs; struct r0conf *conf = kzalloc_obj(*conf); unsigned int blksize = 512;
@@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) *private_conf = ERR_PTR(-ENOMEM); if (!conf) return -ENOMEM; + + nr_devs = 0; rdev_for_each(rdev1, mddev) { + nr_devs++; pr_debug("md/raid0:%s: looking at %pg\n", mdname(mddev), rdev1->bdev);
@@ -147,6 +150,14 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones); if (!conf->strip_zone) goto abort; + + if (nr_devs < mddev->raid_disks) { + pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n", + mdname(mddev), nr_devs, mddev->raid_disks); + err = -EINVAL; + goto abort; + } + conf->devlist = kvzalloc(array3_size(sizeof(struct md_rdev *), conf->nr_strip_zones, mddev->raid_disks),
--
2.55.0