[syzbot] [mm?] WARNING in setup_conf

[syzbot] [mm?] WARNING in setup_conf

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    9d2ed026f031 Merge tag 'sysctl-7.03-rc1' of git://git.kern..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1124919e580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6e414d6e0a79e71d
dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-9d2ed026.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/89c0c0c0f535/vmlinux-9d2ed026.xz
kernel image: https://storage.googleapis.com/syzbot-assets/80d7adeb0e7d/bzImage-9d2ed026.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com

tipc: Started in network mode
tipc: Node identity 2007ff, cluster identity 4711
tipc: Node number set to 2099199
md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
------------[ cut here ]------------
1
WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280, CPU#0: syz.0.0/5310
Modules linked in:
CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280
Code: 74 10 4c 89 e7 89 54 24 0c e8 8e 2d 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 74 6e 18 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
RSP: 0018:ffffc9000d50f520 EFLAGS: 00010246
RAX: ffffc9000d50f500 RBX: 0000000000000015 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d50f588
RBP: ffffc9000d50f610 R08: ffffc9000d50f587 R09: 0000000000000000
R10: ffffc9000d50f560 R11: fffff52001aa1eb1 R12: 0000000000000000
R13: 1ffff92001aa1ea8 R14: 0000000000040dc0 R15: dffffc0000000000
FS:  00007fe2b9aac6c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc93d2c090 CR3: 0000000044100000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 alloc_pages_mpol+0x212/0x390 mm/mempolicy.c:2490
 ___kmalloc_large_node+0x4c/0x120 mm/slub.c:5274
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5305
 __do_kmalloc_node mm/slub.c:5322 [inline]
 __kmalloc_noprof+0x409/0x720 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 setup_conf+0x28b/0xce0 drivers/md/raid10.c:3883
 raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3984
 md_run+0xdbd/0x1e00 drivers/md/md.c:6760
 do_md_run+0x35/0x720 drivers/md/md.c:6861
 md_ioctl+0x1c58/0x2580 drivers/md/md.c:8492
 blkdev_ioctl+0x5e3/0x740 block/ioctl.c:797
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe2b8b9e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe2b9aabfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fe2b8e25fa0 RCX: 00007fe2b8b9e0d9
RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000009
RBP: 00007fe2b8c35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe2b8e26038 R14: 00007fe2b8e25fa0 R15: 00007ffe1ca65d58
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [mm?] WARNING in setup_conf

[Andrew Morton]

On Mon, 24 Aug 2026 17:03:34 -0700 syzbot <syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    9d2ed026f031 Merge tag 'sysctl-7.03-rc1' of git://git.kern..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1124919e580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=6e414d6e0a79e71d
> dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-9d2ed026.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/89c0c0c0f535/vmlinux-9d2ed026.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/80d7adeb0e7d/bzImage-9d2ed026.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com

Thanks.  drivers/md/raid10.c lacks some sanity checking.

In setup_conf():

	/* FIXME calc properly */
	conf->mirrors = kzalloc_objs(struct raid10_info,
				     mddev->raid_disks + max(0, -mddev->delta_disks));

passed a crazy large number into kzalloc_objs(), causing
__alloc_frozen_pages_noprof() to hit

	if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp))
		return NULL;


> tipc: Started in network mode
> tipc: Node identity 2007ff, cluster identity 4711
> tipc: Node number set to 2099199
> md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
> ------------[ cut here ]------------
> 1
> WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280, CPU#0: syz.0.0/5310
> Modules linked in:
> CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280
> Code: 74 10 4c 89 e7 89 54 24 0c e8 8e 2d 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 74 6e 18 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc9000d50f520 EFLAGS: 00010246
> RAX: ffffc9000d50f500 RBX: 0000000000000015 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d50f588
> RBP: ffffc9000d50f610 R08: ffffc9000d50f587 R09: 0000000000000000
> R10: ffffc9000d50f560 R11: fffff52001aa1eb1 R12: 0000000000000000
> R13: 1ffff92001aa1ea8 R14: 0000000000040dc0 R15: dffffc0000000000
> FS:  00007fe2b9aac6c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffc93d2c090 CR3: 0000000044100000 CR4: 0000000000352ef0
> Call Trace:
>  <TASK>
>  alloc_pages_mpol+0x212/0x390 mm/mempolicy.c:2490
>  ___kmalloc_large_node+0x4c/0x120 mm/slub.c:5274
>  __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5305
>  __do_kmalloc_node mm/slub.c:5322 [inline]
>  __kmalloc_noprof+0x409/0x720 mm/slub.c:5359
>  _kmalloc_noprof include/linux/slab.h:992 [inline]
>  _kzalloc_noprof include/linux/slab.h:1309 [inline]
>  setup_conf+0x28b/0xce0 drivers/md/raid10.c:3883
>  raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3984
>  md_run+0xdbd/0x1e00 drivers/md/md.c:6760
>  do_md_run+0x35/0x720 drivers/md/md.c:6861
>  md_ioctl+0x1c58/0x2580 drivers/md/md.c:8492
>  blkdev_ioctl+0x5e3/0x740 block/ioctl.c:797
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:597 [inline]
>  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fe2b8b9e0d9
> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fe2b9aabfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fe2b8e25fa0 RCX: 00007fe2b8b9e0d9
> RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000009
> RBP: 00007fe2b8c35024 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fe2b8e26038 R14: 00007fe2b8e25fa0 R15: 00007ffe1ca65d58
>  </TASK>
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> 
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
> 
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
> 
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
> 
> If you want to undo deduplication, reply with:
> #syz undup

Re: [syzbot] [mm?] WARNING in setup_conf

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    f0100363d8c3 Merge tag 'xfs-fixes-7.3-rc5' of gitolite.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17971805580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=2b924f079099ba6e
dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b20c5e580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10720c5e580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f0100363.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/18fb2734cddb/vmlinux-f0100363.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5737b586e7bc/bzImage-f0100363.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com

md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
syz.0.17 uses obsolete (PF_INET,SOCK_PACKET)
------------[ cut here ]------------
1
WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline], CPU#0: syz.0.17/5462
WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397, CPU#0: syz.0.17/5462
Modules linked in:
CPU: 0 UID: 0 PID: 5462 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:alloc_order_allowed mm/page_alloc.c:5340 [inline]
RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397
Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 2c 98 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d ac 09 54 0e 67 48 0f b9 3a e9 68
RSP: 0018:ffffc90003b87520 EFLAGS: 00010246
RAX: ffffc90003b87500 RBX: 1ffff92000770ea8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000000e RDI: ffffc90003b87588
RBP: ffffc90003b87618 R08: ffffc90003b87587 R09: 0000000000000000
R10: ffffc90003b87560 R11: fffff52000770eb1 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000040dc0 R15: 0000000000000000
FS:  00005555836a7500(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4a2c07ae9c CR3: 000000003bff7000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486
 ___kmalloc_large_node+0x4f/0x120 mm/slub.c:5353
 __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5385
 __do_kmalloc_node mm/slub.c:5402 [inline]
 __kmalloc_noprof+0x3fb/0x720 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 setup_conf+0x28b/0xd30 drivers/md/raid10.c:3855
 raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3955
 md_run+0xc3d/0x1cd0 drivers/md/md.c:6779
 do_md_run+0x35/0x720 drivers/md/md.c:6880
 md_ioctl+0x1e2b/0x2610 drivers/md/md.c:8515
 blkdev_ioctl+0x5e3/0x740 block/ioctl.c:798
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efcb939e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8c37e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007efcb9625fa0 RCX: 00007efcb939e159
RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004
RBP: 00007efcb943506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efcb9625fac R14: 00007efcb9625fa0 R15: 00007efcb9625fa0
 </TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [mm?] WARNING in setup_conf

[Andrew Morton]

tl;dr: a raid issue.

more below:

On Tue, 22 Sep 2026 07:08:43 -0700 syzbot <syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com> wrote:

> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    f0100363d8c3 Merge tag 'xfs-fixes-7.3-rc5' of gitolite.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17971805580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2b924f079099ba6e
> dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b20c5e580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10720c5e580000
> 
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f0100363.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/18fb2734cddb/vmlinux-f0100363.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/5737b586e7bc/bzImage-f0100363.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com
> 
> md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
> syz.0.17 uses obsolete (PF_INET,SOCK_PACKET)
> ------------[ cut here ]------------
> 1
> WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline], CPU#0: syz.0.17/5462
> WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397, CPU#0: syz.0.17/5462
> Modules linked in:
> CPU: 0 UID: 0 PID: 5462 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:alloc_order_allowed mm/page_alloc.c:5340 [inline]
> RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397

Here, core MM is warning that it was asked to allocate a crazy amount
of memory.  By drivers/md/raid10.c:setup_conf().

It's root-only so "don't do that" is a respectable response.  But
adding some sanity check into setup_conf() would make the fuzzer emails
go away so we can concentrate on real stuff.


> Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 2c 98 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d ac 09 54 0e 67 48 0f b9 3a e9 68
> RSP: 0018:ffffc90003b87520 EFLAGS: 00010246
> RAX: ffffc90003b87500 RBX: 1ffff92000770ea8 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 000000000000000e RDI: ffffc90003b87588
> RBP: ffffc90003b87618 R08: ffffc90003b87587 R09: 0000000000000000
> R10: ffffc90003b87560 R11: fffff52000770eb1 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000040dc0 R15: 0000000000000000
> FS:  00005555836a7500(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4a2c07ae9c CR3: 000000003bff7000 CR4: 0000000000352ef0
> Call Trace:
>  <TASK>
>  alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486
>  ___kmalloc_large_node+0x4f/0x120 mm/slub.c:5353
>  __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5385
>  __do_kmalloc_node mm/slub.c:5402 [inline]
>  __kmalloc_noprof+0x3fb/0x720 mm/slub.c:5439
>  _kmalloc_noprof include/linux/slab.h:995 [inline]
>  _kzalloc_noprof include/linux/slab.h:1312 [inline]
>  setup_conf+0x28b/0xd30 drivers/md/raid10.c:3855
>  raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3955
>  md_run+0xc3d/0x1cd0 drivers/md/md.c:6779
>  do_md_run+0x35/0x720 drivers/md/md.c:6880
>  md_ioctl+0x1e2b/0x2610 drivers/md/md.c:8515
>  blkdev_ioctl+0x5e3/0x740 block/ioctl.c:798
>  vfs_ioctl fs/ioctl.c:51 [inline]
>  __do_sys_ioctl fs/ioctl.c:597 [inline]
>  __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7efcb939e159
> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd8c37e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007efcb9625fa0 RCX: 00007efcb939e159
> RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004
> RBP: 00007efcb943506b R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007efcb9625fac R14: 00007efcb9625fa0 R15: 00007efcb9625fa0
>  </TASK>
> 
> 
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.

Forwarded: test bug for patch

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test bug for patch
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..88038d535727 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,16 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  struct md_rdev *rdev;
  size_t r1bio_size;
  int err = -ENOMEM;
+ size_t calculated_size;
+
+ /* prevent baseline integer wrap-around anomalies first*/
+ /* Safely calculate size; overflows automatically saturate to SIZE_MAX */
+
+ calculated_size = size_add(sizeof(struct r1conf),
+   size_mul(mddev->raid_disks, sizeof(struct r1bio)));
+
+ if (mddev->raid_disks <= 0 || calculated_size >= KMALLOC_MAX_SIZE)
+ return ERR_PTR(-EINVAL);

  conf = kzalloc_obj(struct r1conf);
  if (!conf)

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..d35efa876274 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  struct md_rdev *rdev;
  size_t r1bio_size;
  int err = -ENOMEM;
+
+        /* check if mddev->raid_disks is valid before passsing through
kzalloc */
+
+ if(mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);

  conf = kzalloc_obj(struct r1conf);
  if (!conf)

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..d35efa876274 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  struct md_rdev *rdev;
  size_t r1bio_size;
  int err = -ENOMEM;
+
+        /* check if mddev->raid_disks is valid before passsing through
kzalloc */
+
+ if(mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);

  conf = kzalloc_obj(struct r1conf);
  if (!conf)

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..6776e10ce51b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3071,6 +3071,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  if (!conf->barrier)
  goto abort;

+ /* validate mddev->raid_disks before using that in kzalloc */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);
+
  conf->mirrors = kzalloc(array3_size(sizeof(struct raid1_info),
     mddev->raid_disks, 2),
  GFP_KERNEL);

Forwarded: test the patch

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test the patch
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..1cfe983167de 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -48,6 +48,13 @@ static void allow_barrier(struct r1conf *conf,
sector_t sector_nr);
 static void lower_barrier(struct r1conf *conf, sector_t sector_nr);
 static void raid1_free(struct mddev *mddev, void *priv);

+/*
+ * Version 1.x md metadata keeps a 256-byte header and then 2 bytes per
+ * device in a 4096-byte block, so no array described by it can have more
+ * devices than this. Arrays created through the ioctl alone have no
+ * on-disk limit, so apply the same cap to them.
+ */
+#define RAID1_MAX_DISKS ((4096 - 256) / 2)
 #define RAID_1_10_NAME "raid1"
 #include "raid1-10.c"

@@ -3051,6 +3058,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  size_t r1bio_size;
  int err = -ENOMEM;

+ /* raid_disks comes from user space and sizes the allocations below */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > RAID1_MAX_DISKS)
+ return ERR_PTR(-EINVAL);
+
  conf = kzalloc_obj(struct r1conf);
  if (!conf)
  goto abort;

Forwarded: [PATCH] md/raid1: reject out-of-range raid_disks in setup_conf()

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] md/raid1: reject out-of-range raid_disks in setup_conf()
Author: gowtham398gs@gmail.com

mddev->raid_disks can be set from user space with SET_ARRAY_INFO and
is not bounded before RUN_ARRAY reaches raid1_run(). With a very large
value, setup_conf() asks the allocator for more than KMALLOC_MAX_SIZE
when allocating conf->mirrors, and the allocator warns:

  WARNING: mm/slub.c:5459 at ___kmalloc_large_node
   setup_conf+0x15d/0x700
   raid1_run+0x109/0x250
   md_run+0x6c3/0xec0
   do_md_run+0x27/0x3b0
   md_ioctl+0x163f/0x1ca0

The array fails to start, but machines running with panic_on_warn
crash and syzbot keeps reporting it.

Fail early instead. Version 1.x metadata can describe at most 1920
devices, so use that as the upper bound, and test the sign before the
value is used. At that limit the allocations that scale with
raid_disks (conf->mirrors, the r1bio mempool element and the resync
buffers) stay well below KMALLOC_MAX_SIZE.

Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
 drivers/md/raid1.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..1cfe983167de 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -48,6 +48,13 @@ static void allow_barrier(struct r1conf *conf, sector_t sector_nr);
 static void lower_barrier(struct r1conf *conf, sector_t sector_nr);
 static void raid1_free(struct mddev *mddev, void *priv);
 
+/*
+ * Version 1.x md metadata keeps a 256-byte header and then 2 bytes per
+ * device in a 4096-byte block, so no array described by it can have more
+ * devices than this. Arrays created through the ioctl alone have no
+ * on-disk limit, so apply the same cap to them.
+ */
+#define RAID1_MAX_DISKS	((4096 - 256) / 2)
 #define RAID_1_10_NAME "raid1"
 #include "raid1-10.c"
 
@@ -3051,6 +3058,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
 	size_t r1bio_size;
 	int err = -ENOMEM;
 
+	/* raid_disks comes from user space and sizes the allocations below */
+
+	if (mddev->raid_disks <= 0 || mddev->raid_disks > RAID1_MAX_DISKS)
+		return ERR_PTR(-EINVAL);
+
 	conf = kzalloc_obj(struct r1conf);
 	if (!conf)
 		goto abort;
-- 
2.56.0

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: idosch@nvidia.com

#syz test

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c90ee6dd7446..e1e672ada7e7 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3908,9 +3908,12 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
 	}
 
 	/* combine the user config with event to determine if permanent
-	 * addresses are to be removed from address hash table
+	 * addresses are to be removed from address hash table. IPv6 cannot
+	 * operate below IPV6_MIN_MTU, so treat that like disable_ipv6 and do
+	 * not keep addresses without their host routes.
 	 */
-	if (!unregister && !idev->cnf.disable_ipv6) {
+	if (!unregister && !idev->cnf.disable_ipv6 &&
+	    dev->mtu >= IPV6_MIN_MTU) {
 		/* aggregate the system setting and interface setting */
 		int _keep_addr = READ_ONCE(net->ipv6.devconf_all->keep_addr_on_down);
 

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: idosch@nvidia.com

#syz test

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c90ee6dd7446..e1e672ada7e7 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3908,9 +3908,12 @@ static int addrconf_ifdown(struct net_device *dev, bool unregister)
 	}
 
 	/* combine the user config with event to determine if permanent
-	 * addresses are to be removed from address hash table
+	 * addresses are to be removed from address hash table. IPv6 cannot
+	 * operate below IPV6_MIN_MTU, so treat that like disable_ipv6 and do
+	 * not keep addresses without their host routes.
 	 */
-	if (!unregister && !idev->cnf.disable_ipv6) {
+	if (!unregister && !idev->cnf.disable_ipv6 &&
+	    dev->mtu >= IPV6_MIN_MTU) {
 		/* aggregate the system setting and interface setting */
 		int _keep_addr = READ_ONCE(net->ipv6.devconf_all->keep_addr_on_down);
 

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: ihaveihaveihavea@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
master

Testing patch for syzbot bug 97a62389c5611b0477f3.

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: idosch@nvidia.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test
diff --git a/fs/jfs/jfs_txnmgr.h b/fs/jfs/jfs_txnmgr.h
index ba71eb5ced56..391c0d28e1bc 100644
--- a/fs/jfs/jfs_txnmgr.h
+++ b/fs/jfs/jfs_txnmgr.h
@@ -165,7 +165,7 @@ struct linelock {
        u8 l2linesize;          /* 1: log2 of linesize */
        /* (8) */

-       struct lv lv[20];       /* 40: */
+       struct lv lv[]; /* 40: */
 };                             /* (48) */

 #define dt_lock        linelock

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: yun.zhou@windriver.com

#syz test

Forwarded: test

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: test
Author: kriish.sharma2006@gmail.com

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
566771afc7a8