Forwarded: test bug for patch
From: syzbot
Date: Wed Oct 28 2026 - 10:12:49 EST
For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.
***
Subject: test bug for patch
Author: gowtham398gs@xxxxxxxxx
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..88038d535727 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,16 @@ static struct r1conf *setup_conf(struct mddev *mddev)
struct md_rdev *rdev;
size_t r1bio_size;
int err = -ENOMEM;
+ size_t calculated_size;
+
+ /* prevent baseline integer wrap-around anomalies first*/
+ /* Safely calculate size; overflows automatically saturate to SIZE_MAX */
+
+ calculated_size = size_add(sizeof(struct r1conf),
+ size_mul(mddev->raid_disks, sizeof(struct r1bio)));
+
+ if (mddev->raid_disks <= 0 || calculated_size >= KMALLOC_MAX_SIZE)
+ return ERR_PTR(-EINVAL);
conf = kzalloc_obj(struct r1conf);
if (!conf)