[PATCH] md: add max_disks bound check in older version
From: Aaditya Kansal <hidden>
Date: 2026-09-13 23:46:35
Subsystem:
software raid (multiple disks) support, the rest · Maintainers:
Song Liu, Yu Kuai, Linus Torvalds
#syz test
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..f5fce41637f1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c@@ -1693,6 +1693,12 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev) desc_nr = rdev2->raid_disk; else desc_nr = next_spare++; + + if (desc_nr >= MD_SB_DISKS) { + pr_warn("md: raid_disks = %d exceeds max_disks = %d for version 0.90\n", + desc_nr, MD_SB_DISKS); + continue; + } rdev2->desc_nr = desc_nr; d = &sb->disks[rdev2->desc_nr]; nr_disks++;
@@ -1722,7 +1728,7 @@ static void super_90_sync(struct mddev *mddev, struct md_rdev *rdev) d->state |= (1<<MD_DISK_FAILFAST); } /* now set the "removed" and "faulty" bits on any missing devices */ - for (i=0 ; i < mddev->raid_disks ; i++) { + for (i = 0; i < mddev->raid_disks && i < MD_SB_DISKS; i++) { mdp_disk_t *d = &sb->disks[i]; if (d->state == 0 && d->number == 0) { d->number = i; --
2.55.0