* Re: [syzbot] [mm?] WARNING in setup_conf
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
@ 2026-08-25 1:22 ` Andrew Morton
2026-09-22 14:08 ` syzbot
` (6 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: Andrew Morton @ 2026-08-25 1:22 UTC (permalink / raw)
To: syzbot
Cc: apopple, byungchul, david, gourry, joshua.hahnjy, linux-kernel,
linux-mm, matthew.brost, rakie.kim, syzkaller-bugs, ying.huang,
ziy, Song Liu, Yu Kuai, Li Nan, Xiao Ni, linux-raid
On Mon, 24 Aug 2026 17:03:34 -0700 syzbot <syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 9d2ed026f031 Merge tag 'sysctl-7.03-rc1' of git://git.kern..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1124919e580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=6e414d6e0a79e71d
> dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-9d2ed026.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/89c0c0c0f535/vmlinux-9d2ed026.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/80d7adeb0e7d/bzImage-9d2ed026.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com
Thanks. drivers/md/raid10.c lacks some sanity checking.
In setup_conf():
/* FIXME calc properly */
conf->mirrors = kzalloc_objs(struct raid10_info,
mddev->raid_disks + max(0, -mddev->delta_disks));
passed a crazy large number into kzalloc_objs(), causing
__alloc_frozen_pages_noprof() to hit
if (WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp))
return NULL;
> tipc: Started in network mode
> tipc: Node identity 2007ff, cluster identity 4711
> tipc: Node number set to 2099199
> md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
> ------------[ cut here ]------------
> 1
> WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280, CPU#0: syz.0.0/5310
> Modules linked in:
> CPU: 0 UID: 0 PID: 5310 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:__alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280
> Code: 74 10 4c 89 e7 89 54 24 0c e8 8e 2d 0e 00 8b 54 24 0c 49 83 3c 24 00 0f 85 ab fe ff ff e9 ac fe ff ff c6 05 74 6e 18 0e 01 90 <0f> 0b 90 e9 17 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc9000d50f520 EFLAGS: 00010246
> RAX: ffffc9000d50f500 RBX: 0000000000000015 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d50f588
> RBP: ffffc9000d50f610 R08: ffffc9000d50f587 R09: 0000000000000000
> R10: ffffc9000d50f560 R11: fffff52001aa1eb1 R12: 0000000000000000
> R13: 1ffff92001aa1ea8 R14: 0000000000040dc0 R15: dffffc0000000000
> FS: 00007fe2b9aac6c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffc93d2c090 CR3: 0000000044100000 CR4: 0000000000352ef0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x212/0x390 mm/mempolicy.c:2490
> ___kmalloc_large_node+0x4c/0x120 mm/slub.c:5274
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5305
> __do_kmalloc_node mm/slub.c:5322 [inline]
> __kmalloc_noprof+0x409/0x720 mm/slub.c:5359
> _kmalloc_noprof include/linux/slab.h:992 [inline]
> _kzalloc_noprof include/linux/slab.h:1309 [inline]
> setup_conf+0x28b/0xce0 drivers/md/raid10.c:3883
> raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3984
> md_run+0xdbd/0x1e00 drivers/md/md.c:6760
> do_md_run+0x35/0x720 drivers/md/md.c:6861
> md_ioctl+0x1c58/0x2580 drivers/md/md.c:8492
> blkdev_ioctl+0x5e3/0x740 block/ioctl.c:797
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fe2b8b9e0d9
> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fe2b9aabfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fe2b8e25fa0 RCX: 00007fe2b8b9e0d9
> RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000009
> RBP: 00007fe2b8c35024 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fe2b8e26038 R14: 00007fe2b8e25fa0 R15: 00007ffe1ca65d58
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [syzbot] [mm?] WARNING in setup_conf
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
2026-08-25 1:22 ` Andrew Morton
@ 2026-09-22 14:08 ` syzbot
2026-09-22 18:37 ` Andrew Morton
2026-10-28 14:06 ` Forwarded: test bug for patch syzbot
` (5 subsequent siblings)
7 siblings, 1 reply; 10+ messages in thread
From: syzbot @ 2026-09-22 14:08 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, linux-raid, magiclinan, matthew.brost,
rakie.kim, song, syzkaller-bugs, xiao, ying.huang, yukuai, ziy
syzbot has found a reproducer for the following issue on:
HEAD commit: f0100363d8c3 Merge tag 'xfs-fixes-7.3-rc5' of gitolite.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17971805580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2b924f079099ba6e
dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17b20c5e580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10720c5e580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f0100363.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/18fb2734cddb/vmlinux-f0100363.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5737b586e7bc/bzImage-f0100363.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com
md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
syz.0.17 uses obsolete (PF_INET,SOCK_PACKET)
------------[ cut here ]------------
1
WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline], CPU#0: syz.0.17/5462
WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397, CPU#0: syz.0.17/5462
Modules linked in:
CPU: 0 UID: 0 PID: 5462 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:alloc_order_allowed mm/page_alloc.c:5340 [inline]
RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397
Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 2c 98 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d ac 09 54 0e 67 48 0f b9 3a e9 68
RSP: 0018:ffffc90003b87520 EFLAGS: 00010246
RAX: ffffc90003b87500 RBX: 1ffff92000770ea8 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000000000000e RDI: ffffc90003b87588
RBP: ffffc90003b87618 R08: ffffc90003b87587 R09: 0000000000000000
R10: ffffc90003b87560 R11: fffff52000770eb1 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000040dc0 R15: 0000000000000000
FS: 00005555836a7500(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4a2c07ae9c CR3: 000000003bff7000 CR4: 0000000000352ef0
Call Trace:
<TASK>
alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486
___kmalloc_large_node+0x4f/0x120 mm/slub.c:5353
__kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5385
__do_kmalloc_node mm/slub.c:5402 [inline]
__kmalloc_noprof+0x3fb/0x720 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
setup_conf+0x28b/0xd30 drivers/md/raid10.c:3855
raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3955
md_run+0xc3d/0x1cd0 drivers/md/md.c:6779
do_md_run+0x35/0x720 drivers/md/md.c:6880
md_ioctl+0x1e2b/0x2610 drivers/md/md.c:8515
blkdev_ioctl+0x5e3/0x740 block/ioctl.c:798
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efcb939e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd8c37e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007efcb9625fa0 RCX: 00007efcb939e159
RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004
RBP: 00007efcb943506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efcb9625fac R14: 00007efcb9625fa0 R15: 00007efcb9625fa0
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [syzbot] [mm?] WARNING in setup_conf
2026-09-22 14:08 ` syzbot
@ 2026-09-22 18:37 ` Andrew Morton
0 siblings, 0 replies; 10+ messages in thread
From: Andrew Morton @ 2026-09-22 18:37 UTC (permalink / raw)
To: syzbot
Cc: apopple, byungchul, david, gourry, joshua.hahnjy, linux-kernel,
linux-mm, linux-raid, magiclinan, matthew.brost, rakie.kim, song,
syzkaller-bugs, xiao, ying.huang, yukuai, ziy
tl;dr: a raid issue.
more below:
On Tue, 22 Sep 2026 07:08:43 -0700 syzbot <syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com> wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: f0100363d8c3 Merge tag 'xfs-fixes-7.3-rc5' of gitolite.ker..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17971805580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2b924f079099ba6e
> dashboard link: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17b20c5e580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10720c5e580000
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f0100363.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/18fb2734cddb/vmlinux-f0100363.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/5737b586e7bc/bzImage-f0100363.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com
>
> md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
> syz.0.17 uses obsolete (PF_INET,SOCK_PACKET)
> ------------[ cut here ]------------
> 1
> WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline], CPU#0: syz.0.17/5462
> WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397, CPU#0: syz.0.17/5462
> Modules linked in:
> CPU: 0 UID: 0 PID: 5462 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:alloc_order_allowed mm/page_alloc.c:5340 [inline]
> RIP: 0010:__alloc_frozen_pages_noprof+0x425/0x5a0 mm/page_alloc.c:5397
Here, core MM is warning that it was asked to allocate a crazy amount
of memory. By drivers/md/raid10.c:setup_conf().
It's root-only so "don't do that" is a respectable response. But
adding some sanity check into setup_conf() would make the fuzzer emails
go away so we can concentrate on real stuff.
> Code: 90 e9 76 fe ff ff 41 81 e6 3f ff ff ff 44 89 f1 41 83 e6 f7 a9 00 00 00 10 44 0f 44 f1 e9 45 fd ff ff c6 05 2c 98 38 0e 01 90 <0f> 0b 90 e9 8b fe ff ff 48 8d 3d ac 09 54 0e 67 48 0f b9 3a e9 68
> RSP: 0018:ffffc90003b87520 EFLAGS: 00010246
> RAX: ffffc90003b87500 RBX: 1ffff92000770ea8 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 000000000000000e RDI: ffffc90003b87588
> RBP: ffffc90003b87618 R08: ffffc90003b87587 R09: 0000000000000000
> R10: ffffc90003b87560 R11: fffff52000770eb1 R12: 0000000000000000
> R13: 0000000000000000 R14: 0000000000040dc0 R15: 0000000000000000
> FS: 00005555836a7500(0000) GS:ffff88808c2c0000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f4a2c07ae9c CR3: 000000003bff7000 CR4: 0000000000352ef0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486
> ___kmalloc_large_node+0x4f/0x120 mm/slub.c:5353
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5385
> __do_kmalloc_node mm/slub.c:5402 [inline]
> __kmalloc_noprof+0x3fb/0x720 mm/slub.c:5439
> _kmalloc_noprof include/linux/slab.h:995 [inline]
> _kzalloc_noprof include/linux/slab.h:1312 [inline]
> setup_conf+0x28b/0xd30 drivers/md/raid10.c:3855
> raid10_run+0x1d2/0x16c0 drivers/md/raid10.c:3955
> md_run+0xc3d/0x1cd0 drivers/md/md.c:6779
> do_md_run+0x35/0x720 drivers/md/md.c:6880
> md_ioctl+0x1e2b/0x2610 drivers/md/md.c:8515
> blkdev_ioctl+0x5e3/0x740 block/ioctl.c:798
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
> do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7efcb939e159
> Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffd8c37e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007efcb9625fa0 RCX: 00007efcb939e159
> RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004
> RBP: 00007efcb943506b R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007efcb9625fac R14: 00007efcb9625fa0 R15: 00007efcb9625fa0
> </TASK>
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Forwarded: test bug for patch
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
2026-08-25 1:22 ` Andrew Morton
2026-09-22 14:08 ` syzbot
@ 2026-10-28 14:06 ` syzbot
2026-10-29 11:19 ` Forwarded: test syzbot
` (4 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-28 14:06 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: test bug for patch
Author: gowtham398gs@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..88038d535727 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,16 @@ static struct r1conf *setup_conf(struct mddev *mddev)
struct md_rdev *rdev;
size_t r1bio_size;
int err = -ENOMEM;
+ size_t calculated_size;
+
+ /* prevent baseline integer wrap-around anomalies first*/
+ /* Safely calculate size; overflows automatically saturate to SIZE_MAX */
+
+ calculated_size = size_add(sizeof(struct r1conf),
+ size_mul(mddev->raid_disks, sizeof(struct r1bio)));
+
+ if (mddev->raid_disks <= 0 || calculated_size >= KMALLOC_MAX_SIZE)
+ return ERR_PTR(-EINVAL);
conf = kzalloc_obj(struct r1conf);
if (!conf)
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: test
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
` (2 preceding siblings ...)
2026-10-28 14:06 ` Forwarded: test bug for patch syzbot
@ 2026-10-29 11:19 ` syzbot
2026-10-29 14:07 ` syzbot
` (3 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-29 11:19 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: test
Author: gowtham398gs@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..d35efa876274 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
struct md_rdev *rdev;
size_t r1bio_size;
int err = -ENOMEM;
+
+ /* check if mddev->raid_disks is valid before passsing through
kzalloc */
+
+ if(mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);
conf = kzalloc_obj(struct r1conf);
if (!conf)
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: test
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
` (3 preceding siblings ...)
2026-10-29 11:19 ` Forwarded: test syzbot
@ 2026-10-29 14:07 ` syzbot
2026-10-29 18:06 ` syzbot
` (2 subsequent siblings)
7 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-29 14:07 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: test
Author: gowtham398gs@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..d35efa876274 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
struct md_rdev *rdev;
size_t r1bio_size;
int err = -ENOMEM;
+
+ /* check if mddev->raid_disks is valid before passsing through
kzalloc */
+
+ if(mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);
conf = kzalloc_obj(struct r1conf);
if (!conf)
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: test
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
` (4 preceding siblings ...)
2026-10-29 14:07 ` syzbot
@ 2026-10-29 18:06 ` syzbot
2026-10-30 3:09 ` Forwarded: test the patch syzbot
2026-10-30 3:17 ` Forwarded: [PATCH] md/raid1: reject out-of-range raid_disks in setup_conf() syzbot
7 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-29 18:06 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: test
Author: gowtham398gs@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..6776e10ce51b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3071,6 +3071,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
if (!conf->barrier)
goto abort;
+ /* validate mddev->raid_disks before using that in kzalloc */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);
+
conf->mirrors = kzalloc(array3_size(sizeof(struct raid1_info),
mddev->raid_disks, 2),
GFP_KERNEL);
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: test the patch
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
` (5 preceding siblings ...)
2026-10-29 18:06 ` syzbot
@ 2026-10-30 3:09 ` syzbot
2026-10-30 3:17 ` Forwarded: [PATCH] md/raid1: reject out-of-range raid_disks in setup_conf() syzbot
7 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-30 3:09 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: test the patch
Author: gowtham398gs@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..1cfe983167de 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -48,6 +48,13 @@ static void allow_barrier(struct r1conf *conf,
sector_t sector_nr);
static void lower_barrier(struct r1conf *conf, sector_t sector_nr);
static void raid1_free(struct mddev *mddev, void *priv);
+/*
+ * Version 1.x md metadata keeps a 256-byte header and then 2 bytes per
+ * device in a 4096-byte block, so no array described by it can have more
+ * devices than this. Arrays created through the ioctl alone have no
+ * on-disk limit, so apply the same cap to them.
+ */
+#define RAID1_MAX_DISKS ((4096 - 256) / 2)
#define RAID_1_10_NAME "raid1"
#include "raid1-10.c"
@@ -3051,6 +3058,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
size_t r1bio_size;
int err = -ENOMEM;
+ /* raid_disks comes from user space and sizes the allocations below */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > RAID1_MAX_DISKS)
+ return ERR_PTR(-EINVAL);
+
conf = kzalloc_obj(struct r1conf);
if (!conf)
goto abort;
^ permalink raw reply [flat|nested] 10+ messages in thread* Forwarded: [PATCH] md/raid1: reject out-of-range raid_disks in setup_conf()
2026-08-25 0:03 [syzbot] [mm?] WARNING in setup_conf syzbot
` (6 preceding siblings ...)
2026-10-30 3:09 ` Forwarded: test the patch syzbot
@ 2026-10-30 3:17 ` syzbot
7 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-10-30 3:17 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [PATCH] md/raid1: reject out-of-range raid_disks in setup_conf()
Author: gowtham398gs@gmail.com
mddev->raid_disks can be set from user space with SET_ARRAY_INFO and
is not bounded before RUN_ARRAY reaches raid1_run(). With a very large
value, setup_conf() asks the allocator for more than KMALLOC_MAX_SIZE
when allocating conf->mirrors, and the allocator warns:
WARNING: mm/slub.c:5459 at ___kmalloc_large_node
setup_conf+0x15d/0x700
raid1_run+0x109/0x250
md_run+0x6c3/0xec0
do_md_run+0x27/0x3b0
md_ioctl+0x163f/0x1ca0
The array fails to start, but machines running with panic_on_warn
crash and syzbot keeps reporting it.
Fail early instead. Version 1.x metadata can describe at most 1920
devices, so use that as the upper bound, and test the sign before the
value is used. At that limit the allocations that scale with
raid_disks (conf->mirrors, the r1bio mempool element and the resync
buffers) stay well below KMALLOC_MAX_SIZE.
Reported-by: syzbot+75f49ec552cc74d9d69b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
---
drivers/md/raid1.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..1cfe983167de 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -48,6 +48,13 @@ static void allow_barrier(struct r1conf *conf, sector_t sector_nr);
static void lower_barrier(struct r1conf *conf, sector_t sector_nr);
static void raid1_free(struct mddev *mddev, void *priv);
+/*
+ * Version 1.x md metadata keeps a 256-byte header and then 2 bytes per
+ * device in a 4096-byte block, so no array described by it can have more
+ * devices than this. Arrays created through the ioctl alone have no
+ * on-disk limit, so apply the same cap to them.
+ */
+#define RAID1_MAX_DISKS ((4096 - 256) / 2)
#define RAID_1_10_NAME "raid1"
#include "raid1-10.c"
@@ -3051,6 +3058,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
size_t r1bio_size;
int err = -ENOMEM;
+ /* raid_disks comes from user space and sizes the allocations below */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > RAID1_MAX_DISKS)
+ return ERR_PTR(-EINVAL);
+
conf = kzalloc_obj(struct r1conf);
if (!conf)
goto abort;
--
2.56.0
^ permalink raw reply [flat|nested] 10+ messages in thread