[PATCH v3] md/raid0: validate device count before allocating devlist

[Chandradhar Kumar]

create_strip_zones() allocates conf->devlist based on mddev->raid_disks
before verifying that number of devices matches raid_disks. Move the
existing device count validation before allocation to reject invalid
configurations before attempting a potentially excessive allocation.

Fixes: 078d1d8e688d ("md/raid0: use kvzalloc/kvfree for strip_zone and devlist allocations")
Reported-by: syzbot+a32ff75e417c0f49a8e9@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzbot.org/bug?extid=a32ff75e417c0f49a8e9
Signed-off-by: Chandradhar Kumar <chandradhar.2003@xxxxxxxxx>
---
v2 -> v3:
- Move the existing device count validation before the allocation
- Add the requested fixes tag

v1: https://lore.kernel.org/all/20260906143928.105165-1-chandradhar.2003@xxxxxxxxx/
v2: https://lore.kernel.org/all/20260906184406.2141-1-chandradhar.2003@xxxxxxxxx/

 drivers/md/raid0.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..453e8abda22b 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -79,7 +79,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	*private_conf = ERR_PTR(-ENOMEM);
 	if (!conf)
 		return -ENOMEM;
+
+	cnt = 0;
 	rdev_for_each(rdev1, mddev) {
+		cnt++;
 		pr_debug("md/raid0:%s: looking at %pg\n",
 			 mdname(mddev),
 			 rdev1->bdev);
@@ -144,6 +147,14 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 	}
 
 	err = -ENOMEM;
+
+	if (cnt != mddev->raid_disks) {
+		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
+			mdname(mddev), cnt, mddev->raid_disks);
+		err = -EINVAL;
+		goto abort;
+	}
+
 	conf->strip_zone = kvzalloc_objs(struct strip_zone, conf->nr_strip_zones);
 	if (!conf->strip_zone)
 		goto abort;
@@ -200,11 +211,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
 			smallest = rdev1;
 		cnt++;
 	}
-	if (cnt != mddev->raid_disks) {
-		pr_warn("md/raid0:%s: too few disks (%d of %d) - aborting!\n",
-			mdname(mddev), cnt, mddev->raid_disks);
-		goto abort;
-	}
 	zone->nb_dev = cnt;
 	zone->zone_end = smallest->sectors * cnt;
 
-- 
2.55.0