Root Cause Analysis

1. Involved Components and Files

• Functions: md_set_array_info() (drivers/md/md.c), r1buf_pool_alloc() / init_resync() (drivers/md/raid1.c), ___kmalloc_large_node() (mm/slub.c).
• Data Structures: struct mdu_array_info_s, struct mddev, struct r1conf, struct resync_pages.
• Source Files: drivers/md/md.c, drivers/md/raid1.c.

2. Mechanism and Trigger Path

1. Unchecked raid_disks Setting: A privileged user (CAP_SYS_ADMIN) issues the SET_ARRAY_INFO ioctl on an uninitialized MD device (/dev/md0). In drivers/md/md.c:md_set_array_info(), the kernel sets mddev->raid_disks directly from user input (info->raid_disks) without verifying that info->raid_disks is within sane or allocatable bounds:

   mddev->raid_disks = info->raid_disks;
   

   In the reproducer, info->raid_disks is configured to 0x8002 (32,770) with info->not_persistent = 0x2000.

2. Array Initialization and Sync Thread Kickoff: When the RUN_ARRAY ioctl is subsequently called (md_run() -> raid1_run() -> setup_conf()), conf->mirrors is allocated with kzalloc(array3_size(sizeof(struct raid1_info), mddev->raid_disks, 2), GFP_KERNEL) (~2 MiB) and conf->r1bio_pool is created with elements of size offsetof(struct r1bio, bios[mddev->raid_disks * 2]) (~512 KiB). Both allocations are below KMALLOC_MAX_SIZE (4 MiB on x86-64), so setup_conf() succeeds and the MD resync thread (md_do_sync()) is spawned.

3. Excessive Allocation in Resync Buffer Pool: Once md_do_sync() executes, it calls pers->sync_request (raid1_sync_request()). Because conf->r1buf_pool is not yet initialized, it calls init_resync(conf):

   buffs = RESYNC_WINDOW / RESYNC_BLOCK_SIZE;
   return mempool_init(&conf->r1buf_pool, buffs, r1buf_pool_alloc,
                       r1buf_pool_free, conf);
   

   mempool_init() invokes r1buf_pool_alloc() in drivers/md/raid1.c:

   rps = kmalloc_objs(struct resync_pages, conf->raid_disks * 2, gfp_flags);
   

   • sizeof(struct resync_pages) is 136 bytes (void *raid_bio + 16 page pointers pages[16]).
   • conf->raid_disks * 2 is 32770 * 2 = 65540 (0x10004).
   • The total requested size is 65540 * 136 = 8,913,440 bytes (0x880220 bytes, ~8.5 MiB).

4. Triggering the Warning: Because 0x880220 exceeds KMALLOC_MAX_SIZE (0x400000 / 4 MiB), ___kmalloc_large_node() in mm/slub.c detects size > KMALLOC_MAX_SIZE with gfp_flags lacking __GFP_NOWARN, triggering the warning:

   if (WARN_ON_ONCE_GFP(size > KMALLOC_MAX_SIZE, flags))
       return NULL;
   

   After the warning is emitted, ___kmalloc_large_node() returns NULL. r1buf_pool_alloc() safely aborts via goto out_free_r1bio; and returns NULL, which causes mempool_init_node() to clean up and return -ENOMEM. raid1_sync_request() returns 0, and md_do_sync() catches this condition (sectors == 0), sets MD_RECOVERY_INTR, and gracefully terminates the resync loop without crashing or corrupting memory.