Re: [PATCH] md/raid1: Prevent excessively large memory allocations

[yu kuai]

Hi,

在 2026/10/28 23:27, Gowtham S Bhushan 写道:
> Validate mddev->raid_disks before memory allocation to prevent integer
> wrap-around or allocating an unreasonably large chunk of memory that
> exceeds KMALLOC_MAX_SIZE boundaries.
>
> Reported-by: syzbot+75f49ec552cc74d9d69b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Tested-by: syzbot+75f49ec552cc74d9d69b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: syzkaller-bugs@xxxxxxxxxxxxxxxx
>
> Signed-off-by: Gowtham S Bhushan <gowtham398gs@xxxxxxxxx>
> ---
>   drivers/md/raid1.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
>
> diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
> index f0646fb24371..88038d535727 100644
> --- a/drivers/md/raid1.c
> +++ b/drivers/md/raid1.c
> @@ -3050,6 +3050,16 @@ static struct r1conf *setup_conf(struct mddev *mddev)
>   	struct md_rdev *rdev;
>   	size_t r1bio_size;
>   	int err = -ENOMEM;
> +	size_t calculated_size;
> +
> +	/* prevent baseline integer wrap-around anomalies first*/
> +	/* Safely calculate size; overflows automatically saturate to SIZE_MAX */
> +
> +	calculated_size = size_add(sizeof(struct r1conf),
> +				   size_mul(mddev->raid_disks, sizeof(struct r1bio)));

This is not the only place, raid1_reshape() has the same memory allocation.

> +
> +	if (mddev->raid_disks <= 0 || calculated_size >= KMALLOC_MAX_SIZE)
> +		return ERR_PTR(-EINVAL);
>   
>   	conf = kzalloc_obj(struct r1conf);
>   	if (!conf)

-- 
Thanks,
Kuai