diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index f0646fb24371..88038d535727 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3050,6 +3050,16 @@ static struct r1conf *setup_conf(struct mddev *mddev) struct md_rdev *rdev; size_t r1bio_size; int err = -ENOMEM; + size_t calculated_size; + + /* prevent baseline integer wrap-around anomalies first*/ + /* Safely calculate size; overflows automatically saturate to SIZE_MAX */ + + calculated_size = size_add(sizeof(struct r1conf), + size_mul(mddev->raid_disks, sizeof(struct r1bio))); + + if (mddev->raid_disks <= 0 || calculated_size >= KMALLOC_MAX_SIZE) + return ERR_PTR(-EINVAL); conf = kzalloc_obj(struct r1conf); if (!conf)