diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..6776e10ce51b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -3071,6 +3071,11 @@ static struct r1conf *setup_conf(struct mddev *mddev)
  if (!conf->barrier)
  goto abort;

+ /* validate mddev->raid_disks before using that in kzalloc */
+
+ if (mddev->raid_disks <= 0 || mddev->raid_disks > MAX_RAID_DISKS)
+ return ERR_PTR(-EINVAL);
+
  conf->mirrors = kzalloc(array3_size(sizeof(struct raid1_info),
     mddev->raid_disks, 2),
  GFP_KERNEL);