Junrui Luo 9d8e03b9a2 md/raid10: fix divide-by-zero in setup_geo() with zero far_copies ...

commit 9aa6d860b0 upstream.

setup_geo() extracts near_copies (nc) and far_copies (fc) from the
user-provided layout parameter without checking for zero. When fc=0
with the "improved" far set layout selected, 'geo->far_set_size =
disks / fc' triggers a divide-by-zero.

Validate nc and fc immediately after extraction, returning -1 if
either is zero.

Fixes: 475901aff1 ("MD RAID10: Improve redundancy for 'far' and 'offset' algorithms (part 1)")
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://lore.kernel.org/linux-raid/SYBPR01MB7881A5E2556806CC1D318582AF232@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-05-14 15:29:24 +02:00

..

bcache

bcache: fix cached_dev.sb_bio use-after-free and crash

2026-04-22 13:19:03 +02:00

dm-vdo

…

persistent-data

dm-thin: fix metadata refcount underflow

2026-05-14 15:29:24 +02:00

dm-audit.c

…

dm-audit.h

…

dm-bio-prison-v1.c

…

dm-bio-prison-v1.h

…

dm-bio-prison-v2.c

…

dm-bio-prison-v2.h

…

dm-bio-record.h

…

dm-bufio.c

dm-bufio: align write boundary on physical block size

2026-01-08 10:14:44 +01:00

dm-builtin.c

…

dm-cache-background-tracker.c

…

dm-cache-background-tracker.h

…

dm-cache-block-types.h

…

dm-cache-metadata.c

…

dm-cache-metadata.h

…

dm-cache-policy-internal.h

…

dm-cache-policy-smq.c

…

dm-cache-policy.c

…

dm-cache-policy.h

…

dm-cache-target.c

…

dm-clone-metadata.c

…

dm-clone-metadata.h

…

dm-clone-target.c

…

dm-core.h

…

dm-crypt.c

…

dm-delay.c

…

dm-dust.c

…

dm-ebs-target.c

dm-ebs: Mark full buffer dirty even on partial write

2026-01-08 10:14:44 +01:00

dm-era-target.c

…

dm-exception-store.c

dm: replace -EEXIST with -EBUSY

2026-03-04 07:21:11 -05:00

dm-exception-store.h

dm-snapshot: fix 'scheduling while atomic' on real-time kernels

2026-01-17 16:31:19 +01:00

dm-flakey.c

…

dm-ima.c

…

dm-ima.h

…

dm-init.c

…

dm-integrity.c

dm-integrity: fix recalculation in bitmap mode

2026-03-04 07:21:45 -05:00

dm-io-rewind.c

…

dm-io-tracker.h

…

dm-io.c

…

dm-ioctl.c

dm: fix a buffer overflow in ioctl processing

2026-05-14 15:29:24 +02:00

dm-kcopyd.c

…

dm-linear.c

…

dm-log-userspace-base.c

…

dm-log-userspace-transfer.c

…

dm-log-userspace-transfer.h

…

dm-log-writes.c

dm log-writes: Add missing set_freezable() for freezable kthread

2025-12-18 13:55:21 +01:00

dm-log.c

dm: replace -EEXIST with -EBUSY

2026-03-04 07:21:11 -05:00

dm-mpath.c

dm mpath: make pg_init_delay_msecs settable

2026-03-04 07:21:50 -05:00

dm-mpath.h

…

dm-path-selector.c

dm: replace -EEXIST with -EBUSY

2026-03-04 07:21:11 -05:00

dm-path-selector.h

…

dm-ps-historical-service-time.c

…

dm-ps-io-affinity.c

…

dm-ps-queue-length.c

…

dm-ps-round-robin.c

…

dm-ps-service-time.c

…

dm-raid1.c

dm mirror: fix integer overflow in create_dirty_log()

2026-05-07 06:09:42 +02:00

dm-raid.c

dm-raid: fix possible NULL dereference with undefined raid type

2025-12-18 13:55:21 +01:00

dm-region-hash.c

…

dm-rq.c

dm: clear cloned request bio pointer when last clone bio completes

2026-03-04 07:21:44 -05:00

dm-rq.h

…

dm-snap-persistent.c

…

dm-snap-transient.c

…

dm-snap.c

dm-snapshot: fix 'scheduling while atomic' on real-time kernels

2026-01-17 16:31:19 +01:00

dm-stats.c

…

dm-stats.h

…

dm-stripe.c

…

dm-switch.c

…

dm-sysfs.c

…

dm-table.c

…

dm-target.c

dm: replace -EEXIST with -EBUSY

2026-03-04 07:21:11 -05:00

dm-thin-metadata.c

…

dm-thin-metadata.h

…

dm-thin.c

…

dm-uevent.c

…

dm-uevent.h

…

dm-unstripe.c

dm-unstripe: fix mapping bug when there are multiple targets in a table

2026-03-04 07:21:46 -05:00

dm-verity-fec.c

dm-verity-fec: correctly reject too-small hash devices

2026-05-14 15:29:24 +02:00

dm-verity-fec.h

dm-verity: disable recursive forward error correction

2026-03-25 11:08:44 +01:00

dm-verity-loadpin.c

…

dm-verity-target.c

…

dm-verity-verify-sig.c

…

dm-verity-verify-sig.h

…

dm-verity.h

…

dm-writecache.c

…

dm-zero.c

…

dm-zone.c

dm: use READ_ONCE in dm_blk_report_zones

2026-03-04 07:20:00 -05:00

dm-zoned-metadata.c

…

dm-zoned-reclaim.c

…

dm-zoned-target.c

…

dm-zoned.h

…

dm.c

dm: use bio_clone_blkg_association

2026-03-04 07:20:04 -05:00

dm.h

…

Kconfig

…

Makefile

…

md-autodetect.c

…

md-bitmap.c

md/bitmap: fix GPF in write_page caused by resize race

2026-03-04 07:21:49 -05:00

md-bitmap.h

…

md-cluster.c

md-cluster: fix NULL pointer dereference in process_metadata_update

2026-03-04 07:20:55 -05:00

md-cluster.h

…

md-linear.c

…

md.c

md: suspend array while updating raid_disks via sysfs

2026-02-11 13:40:19 +01:00

md.h

…

raid0.c

…

raid0.h

…

raid1-10.c

…

raid1.c

md/raid1: fix memory leak in raid1_run()

2026-03-04 07:19:30 -05:00

raid1.h

…

raid5-cache.c

md/raid5: validate payload size before accessing journal metadata

2026-05-07 06:09:39 +02:00

raid5-log.h

…

raid5-ppl.c

…

raid5.c

md/raid5: fix soft lockup in retry_aligned_read()

2026-05-07 06:09:39 +02:00

raid5.h

…

raid10.c

md/raid10: fix divide-by-zero in setup_geo() with zero far_copies

2026-05-14 15:29:24 +02:00

raid10.h

…