create_strip_zones() allocates conf->devlist based on mddev->raid_disks
before verifying that enough devices are present. Validate the number of
member devices before allocating devlist to reject invalid
configurations early.

The existing validation later in the function already rejects this
condition, but it occurs after the potentially excessive allocation.

Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>

v2:
- Reject non-positive raid-disks values, which can bypass the device
  count validation and result in an oversized allocation.
---
 drivers/md/raid0.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..8eaf078606d6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	sector_t curr_zone_end, sectors;
 	struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev;
 	struct strip_zone *zone;
-	int cnt;
+	int cnt, nr_devs;
 	struct r0conf *conf = kzalloc_obj(*conf);
 	unsigned int blksize = 512;
 
@@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	*private_conf = ERR_PTR(-ENOMEM);
 	if (!conf)
 		return -ENOMEM;
+
+	nr_devs = 0;
 	rdev_for_each(rdev1, mddev) {
+		nr_devs++;
 		pr_debug("md/raid0:%s: looking at %pg\n",
 			 mdname(mddev),
 			 rdev1->bdev);
@@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	}
 
 	err = -ENOMEM;
+
+	if (mddev->raid_disks <= 0) {
+		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
+			mdname(mddev), mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
+	if (nr_devs < mddev->raid_disks) {
+		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
+			mdname(mddev), nr_devs, mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
 	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
 	if (!conf->strip_zone)
 		goto abort;
-- 
2.55.0

Hi,

在 2026/9/7 2:44, Chandradhar Kumar 写道:
> create_strip_zones() allocates conf->devlist based on mddev->raid_disks
> before verifying that enough devices are present. Validate the number of
> member devices before allocating devlist to reject invalid
> configurations early.
>
> The existing validation later in the function already rejects this
> condition, but it occurs after the potentially excessive allocation.

Since there is already a checking cnt != mddev->raid_disks, it doesn't make
sense to introduce redundant checking. Please move the checking forward to
fix the problem.

>
> Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9

Please add a fix tag.

> Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
>
> v2:
> - Reject non-positive raid-disks values, which can bypass the device
>    count validation and result in an oversized allocation.
> ---

And change log should not be placed in commit message. Just move them here, and they
will be dropped when I apply the patch.

>   drivers/md/raid0.c | 20 +++++++++++++++++++-
>   1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
> index 35e103f0c2c3..8eaf078606d6 100644
> --- a/drivers/md/raid0.c
> +++ b/drivers/md/raid0.c
> @@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	sector_t curr_zone_end, sectors;
>   	struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev;
>   	struct strip_zone *zone;
> -	int cnt;
> +	int cnt, nr_devs;
>   	struct r0conf *conf = kzalloc_obj(*conf);
>   	unsigned int blksize = 512;
>   
> @@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	*private_conf = ERR_PTR(-ENOMEM);
>   	if (!conf)
>   		return -ENOMEM;
> +
> +	nr_devs = 0;
>   	rdev_for_each(rdev1, mddev) {
> +		nr_devs++;
>   		pr_debug("md/raid0:%s: looking at %pg\n",
>   			 mdname(mddev),
>   			 rdev1->bdev);
> @@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	}
>   
>   	err = -ENOMEM;
> +
> +	if (mddev->raid_disks <= 0) {
> +		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
> +			mdname(mddev), mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
> +	if (nr_devs < mddev->raid_disks) {
> +		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
> +			mdname(mddev), nr_devs, mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
>   	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
>   	if (!conf->strip_zone)
>   		goto abort;

-- 
Thanks,
Kuai