Forwarded: test the patch

[syzbot <syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: test the patch
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..1cfe983167de 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -48,6 +48,13 @@ static void allow_barrier(struct r1conf *conf,
sector_t sector_nr);
 static void lower_barrier(struct r1conf *conf, sector_t sector_nr);
 static void raid1_free(struct mddev *mddev, void *priv);

+/*
+ * Version 1.x md metadata keeps a 256-byte header and then 2 bytes per
+ * device in a 4096-byte block, so no array described by it can have more
+ * devices than this. Arrays created through the ioctl alone have no
+ * on-disk limit, so apply the same cap to them.
+ */
+#define RAID1_MAX_DISKS ((4096 - 256) / 2)
 #define RAID_1_10_NAME "raid1"
 #include "raid1-10.c"

@@ -3051,6 +3058,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  size_t r1bio_size;
  int err = -ENOMEM;

+ /* raid_disks comes from user space and sizes the allocations below */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > RAID1_MAX_DISKS)
+ return ERR_PTR(-EINVAL);
+
  conf = kzalloc_obj(struct r1conf);
  if (!conf)
  goto abort;