[PATCH v3] md/raid0: validate device count before allocating devlist
From: Chandradhar Kumar <hidden>
Date: 2026-09-07 13:29:53
Also in:
lkml
Subsystem:
software raid (multiple disks) support, the rest · Maintainers:
Song Liu, Yu Kuai, Linus Torvalds
create_strip_zones() allocates conf->devlist based on mddev->raid_disks
before verifying that number of devices matches raid_disks. Move the
existing device count validation before allocation to reject invalid
configurations before attempting a potentially excessive allocation.
Fixes: 078d1d8e688d ("md/raid0: use kvzalloc/kvfree for strip_zone and devlist allocations")
Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9
Signed-off-by: Chandradhar Kumar <redacted>
---
v2 -> v3:
- Move the existing device count validation before the allocation
- Add the requested fixes tag
v1: https://lore.kernel.org/all/20260906143928.105165-1-chandradhar.2003@gmail.com/ (local)
v2: https://lore.kernel.org/all/20260906184406.2141-1-chandradhar.2003@gmail.com/ (local)
drivers/md/raid0.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..453e8abda22b 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c@@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) *private_conf = ERR_PTR(-ENOMEM); if (!conf) return -ENOMEM; + + cnt = 0; rdev_for_each(rdev1, mddev) { + cnt++; pr_debug("md/raid0:%s: looking at %pg\n", mdname(mddev), rdev1->bdev);
@@ -144,6 +147,14 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) } err = -ENOMEM; + + if (cnt != mddev->raid_disks) { + pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n", + mdname(mddev), cnt, mddev->raid_disks); + err = -EINVAL; + goto abort; + } + conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones); if (!conf->strip_zone) goto abort;
@@ -200,11 +211,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf) smallest = rdev1; cnt++; } - if (cnt != mddev->raid_disks) { - pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n", - mdname(mddev), cnt, mddev->raid_disks); - goto abort; - } zone->nb_dev = cnt; zone->zone_end = smallest->sectors * cnt;
--
2.55.0