[PATCH] md/raid1: Prevent excessively large memory allocations

[Gowtham S Bhushan]

Validate mddev->raid_disks before memory allocation to prevent integer
wrap-around or allocating an unreasonably large chunk of memory that
exceeds KMALLOC_MAX_SIZE boundaries.

Reported-by: syzbot+75f49ec552cc74d9d69b@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=75f49ec552cc74d9d69b
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Tested-by: syzbot+75f49ec552cc74d9d69b@xxxxxxxxxxxxxxxxxxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Cc: syzkaller-bugs@xxxxxxxxxxxxxxxx

Signed-off-by: Gowtham S Bhushan <gowtham398gs@xxxxxxxxx>
---
 drivers/md/raid1.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..88038d535727 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3050,6 +3050,16 @@ static struct r1conf *setup_conf(struct mddev *mddev)
 	struct md_rdev *rdev;
 	size_t r1bio_size;
 	int err = -ENOMEM;
+	size_t calculated_size;
+
+	/* prevent baseline integer wrap-around anomalies first*/
+	/* Safely calculate size; overflows automatically saturate to SIZE_MAX */
+
+	calculated_size = size_add(sizeof(struct r1conf),
+				   size_mul(mddev->raid_disks, sizeof(struct r1bio)));
+
+	if (mddev->raid_disks <= 0 || calculated_size >= KMALLOC_MAX_SIZE)
+		return ERR_PTR(-EINVAL);
 
 	conf = kzalloc_obj(struct r1conf);
 	if (!conf)
-- 
2.56.0