Re: [PATCH v2] md/raid0: validate device count before allocating devlist

["yu kuai" <yukuai@fygo.io>]

Hi,

在 2026/9/7 2:44, Chandradhar Kumar 写道:
> create_strip_zones() allocates conf->devlist based on mddev->raid_disks
> before verifying that enough devices are present. Validate the number of
> member devices before allocating devlist to reject invalid
> configurations early.
>
> The existing validation later in the function already rejects this
> condition, but it occurs after the potentially excessive allocation.

Since there is already a checking cnt != mddev->raid_disks, it doesn't make
sense to introduce redundant checking. Please move the checking forward to
fix the problem.

>
> Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9

Please add a fix tag.

> Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
>
> v2:
> - Reject non-positive raid-disks values, which can bypass the device
>    count validation and result in an oversized allocation.
> ---

And change log should not be placed in commit message. Just move them here, and they
will be dropped when I apply the patch.

>   drivers/md/raid0.c | 20 +++++++++++++++++++-
>   1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
> index 35e103f0c2c3..8eaf078606d6 100644
> --- a/drivers/md/raid0.c
> +++ b/drivers/md/raid0.c
> @@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	sector_t curr_zone_end, sectors;
>   	struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev;
>   	struct strip_zone *zone;
> -	int cnt;
> +	int cnt, nr_devs;
>   	struct r0conf *conf = kzalloc_obj(*conf);
>   	unsigned int blksize = 512;
>   
> @@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	*private_conf = ERR_PTR(-ENOMEM);
>   	if (!conf)
>   		return -ENOMEM;
> +
> +	nr_devs = 0;
>   	rdev_for_each(rdev1, mddev) {
> +		nr_devs++;
>   		pr_debug("md/raid0:%s: looking at %pg\n",
>   			 mdname(mddev),
>   			 rdev1->bdev);
> @@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	}
>   
>   	err = -ENOMEM;
> +
> +	if (mddev->raid_disks <= 0) {
> +		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
> +			mdname(mddev), mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
> +	if (nr_devs < mddev->raid_disks) {
> +		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
> +			mdname(mddev), nr_devs, mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
>   	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
>   	if (!conf->strip_zone)
>   		goto abort;

-- 
Thanks,
Kuai