[PATCH v2] md/raid0: validate device count before allocating devlist

[PATCH v2] md/raid0: validate device count before allocating devlist

[Chandradhar Kumar]

create_strip_zones() allocates conf->devlist based on mddev->raid_disks
before verifying that enough devices are present. Validate the number of
member devices before allocating devlist to reject invalid
configurations early.

The existing validation later in the function already rejects this
condition, but it occurs after the potentially excessive allocation.

Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>

v2:
- Reject non-positive raid-disks values, which can bypass the device
  count validation and result in an oversized allocation.
---
 drivers/md/raid0.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..8eaf078606d6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	sector_t curr_zone_end, sectors;
 	struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev;
 	struct strip_zone *zone;
-	int cnt;
+	int cnt, nr_devs;
 	struct r0conf *conf = kzalloc_obj(*conf);
 	unsigned int blksize = 512;
 
@@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	*private_conf = ERR_PTR(-ENOMEM);
 	if (!conf)
 		return -ENOMEM;
+
+	nr_devs = 0;
 	rdev_for_each(rdev1, mddev) {
+		nr_devs++;
 		pr_debug("md/raid0:%s: looking at %pg\n",
 			 mdname(mddev),
 			 rdev1->bdev);
@@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	}
 
 	err = -ENOMEM;
+
+	if (mddev->raid_disks <= 0) {
+		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
+			mdname(mddev), mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
+	if (nr_devs < mddev->raid_disks) {
+		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
+			mdname(mddev), nr_devs, mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
 	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
 	if (!conf->strip_zone)
 		goto abort;
-- 
2.55.0

[PATCH v2] md/raid0: validate device count before allocating devlist

[Chandradhar Kumar]

create_strip_zones() allocates conf->devlist based on mddev->raid_disks
before verifying that enough devices are present. Validate the number of
member devices before allocating devlist to reject invalid
configurations early.

The existing validation later in the function already rejects this
condition, but it occurs after the potentially excessive allocation.

Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9
Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>

v2:
- Reject non-positive raid-disks values, which can bypass the device
  count validation and result in an oversized allocation.
---
 drivers/md/raid0.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..8eaf078606d6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	sector_t curr_zone_end, sectors;
 	struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev;
 	struct strip_zone *zone;
-	int cnt;
+	int cnt, nr_devs;
 	struct r0conf *conf = kzalloc_obj(*conf);
 	unsigned int blksize = 512;
 
@@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	*private_conf = ERR_PTR(-ENOMEM);
 	if (!conf)
 		return -ENOMEM;
+
+	nr_devs = 0;
 	rdev_for_each(rdev1, mddev) {
+		nr_devs++;
 		pr_debug("md/raid0:%s: looking at %pg\n",
 			 mdname(mddev),
 			 rdev1->bdev);
@@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	}
 
 	err = -ENOMEM;
+
+	if (mddev->raid_disks <= 0) {
+		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
+			mdname(mddev), mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
+	if (nr_devs < mddev->raid_disks) {
+		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
+			mdname(mddev), nr_devs, mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
 	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
 	if (!conf->strip_zone)
 		goto abort;
-- 
2.55.0

Re: [PATCH v2] md/raid0: validate device count before allocating devlist

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer overflow in `chunk_size` sysfs handler allows a zero-division kernel panic in `map_sector()`.
--

commit ff4c12b29e562bce41f4e75365704e1e7f8e00b2
Author: Chandradhar Kumar <chandradhar.2003@gmail.com>

md/raid0: validate device count before allocating devlist

create_strip_zones() allocates conf->devlist based on mddev->raid_disks
before verifying that enough devices are present. Validate the number of
member devices before allocating devlist to reject invalid
configurations early.

Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9

> diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
> index 35e103f0c2c3e..8eaf078606d6f 100644
> --- a/drivers/md/raid0.c
> +++ b/drivers/md/raid0.c
[ ... ]
> @@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>  	}
>  
>  	err = -ENOMEM;
> +
> +	if (mddev->raid_disks <= 0) {
> +		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
> +			mdname(mddev), mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
> +	if (nr_devs < mddev->raid_disks) {
> +		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
> +			mdname(mddev), nr_devs, mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
>  	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);

[Severity: High]
This is a pre-existing issue, but does this code allow an integer overflow
in mddev->chunk_sectors that leads to a division-by-zero kernel panic in
map_sector()?

In drivers/md/md.c:chunk_size_store(), the chunk size is parsed with no
upper bounds checking:

	err = kstrtoul(buf, 10, &n);
	...
	mddev->chunk_sectors = n >> 9;

A large value written to the chunk_size sysfs node of a non-running RAID0
array is bitshifted and truncated into the 32-bit signed integer
mddev->chunk_sectors.

When the array is started and I/O is submitted, the code in map_sector()
can overflow:

drivers/md/raid0.c:map_sector() {
	...
		sector_div(chunk, zone->nb_dev << chunksect_bits);
	} else{
		sect_in_chunk = sector_div(sector, chunk_sects);
		chunk = *sector_offset;
		sector_div(chunk, chunk_sects * zone->nb_dev);
	}
	...
}

If chunk_sects is a power of 2 (e.g., 0x80000000) and nb_dev = 2,
zone->nb_dev << chunksect_bits evaluates to 2 << 31, which overflows to 0
in 32-bit math.

If chunk_sects is not a power of 2 (e.g., 0xC0000000) and nb_dev = 4,
chunk_sects * zone->nb_dev evaluates to 0xC0000000 * 4, which also overflows
to 0.

In both branches, sector_div(chunk, 0) executes and panics the kernel. Can
chunk_size_store() be updated to validate the upper bounds of chunk_size to
prevent this crash?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906184406.2141-1-chandradhar.2003@gmail.com?part=1

Re: [PATCH v2] md/raid0: validate device count before allocating devlist

[yu kuai]

Hi,

在 2026/9/7 2:44, Chandradhar Kumar 写道:
> create_strip_zones() allocates conf->devlist based on mddev->raid_disks
> before verifying that enough devices are present. Validate the number of
> member devices before allocating devlist to reject invalid
> configurations early.
>
> The existing validation later in the function already rejects this
> condition, but it occurs after the potentially excessive allocation.

Since there is already a checking cnt != mddev->raid_disks, it doesn't make
sense to introduce redundant checking. Please move the checking forward to
fix the problem.

>
> Reported-by: syzbot+a32ff75e417c0f49a8e9@syzkaller.appspotmail.com
> Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9

Please add a fix tag.

> Signed-off-by: Chandradhar Kumar <chandradhar.2003@gmail.com>
>
> v2:
> - Reject non-positive raid-disks values, which can bypass the device
>    count validation and result in an oversized allocation.
> ---

And change log should not be placed in commit message. Just move them here, and they
will be dropped when I apply the patch.

>   drivers/md/raid0.c | 20 +++++++++++++++++++-
>   1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
> index 35e103f0c2c3..8eaf078606d6 100644
> --- a/drivers/md/raid0.c
> +++ b/drivers/md/raid0.c
> @@ -69,7 +69,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	sector_t curr_zone_end, sectors;
>   	struct md_rdev *smallest, *rdev1, *rdev2, *rdev, **dev;
>   	struct strip_zone *zone;
> -	int cnt;
> +	int cnt, nr_devs;
>   	struct r0conf *conf = kzalloc_obj(*conf);
>   	unsigned int blksize = 512;
>   
> @@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	*private_conf = ERR_PTR(-ENOMEM);
>   	if (!conf)
>   		return -ENOMEM;
> +
> +	nr_devs = 0;
>   	rdev_for_each(rdev1, mddev) {
> +		nr_devs++;
>   		pr_debug("md/raid0:%s: looking at %pg\n",
>   			 mdname(mddev),
>   			 rdev1->bdev);
> @@ -144,6 +147,21 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
>   	}
>   
>   	err = -ENOMEM;
> +
> +	if (mddev->raid_disks <= 0) {
> +		pr_warn("md/raid0:%s: invalid number of disks %d - aborting!\n",
> +			mdname(mddev), mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
> +	if (nr_devs < mddev->raid_disks) {
> +		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
> +			mdname(mddev), nr_devs, mddev->raid_disks);
> +		err = -EINVAL;
> +		goto abort;
> +	}
> +
>   	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
>   	if (!conf->strip_zone)
>   		goto abort;

-- 
Thanks,
Kuai