[PATCH 1/6] nvme: reject a reconnect_delay of 0 through sysfs

[Hannes Reinecke]

On 11/6/26 2:58 AM, Guixin Liu wrote:
> nvme_ctrl_reconnect_delay_store() accepts any value the option parser
> also accepts, except that it misses the lower bound: writing 0 is
> rejected by nvmf_parse_options() but not by the sysfs attribute.
> nvme_ctrl_loss_tmo_store() then divides by opts->reconnect_delay in
> DIV_ROUND_UP(), so writing 0 followed by any ctrl_loss_tmo update
> crashes the kernel with a division by zero.
> 
> Reject 0 like the option parser does.
> 
> Fixes: 42a45274c2258 ("nvme-fabrics: Allow ctrl loss timeout configuration")
> Cc: stable at vger.kernel.org
> Signed-off-by: Guixin Liu <kanie at linux.alibaba.com>
> ---
> 
> Reproduced on an unfixed 7.3.0-rc7 kernel in a VM with a fabrics
> controller connected:
> 
>    echo 0 > /sys/class/nvme/nvme1/reconnect_delay
>    echo 30 > /sys/class/nvme/nvme1/ctrl_loss_tmo
> 
>    Oops: divide error: 0000 [#1] SMP KASAN PTI
>    CPU: 7 UID: 0 PID: 1542 Comm: bash Not tainted 7.3.0-rc7
>    RIP: 0010:nvme_ctrl_loss_tmo_store+0xce/0x120 [nvme_core]
>    Code: ... 8d 44 08 ff <f7> f1 ...
>    RAX: 000000000000001d RCX: 0000000000000000
> 
> Verified on the patched kernel: writing 0 returns -EINVAL and the
> ctrl_loss_tmo update succeeds without an oops.
> ---
>   drivers/nvme/host/sysfs.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
> index 10018c6356b6..bae0d6258d01 100644
> --- a/drivers/nvme/host/sysfs.c
> +++ b/drivers/nvme/host/sysfs.c
> @@ -634,6 +634,9 @@ static ssize_t nvme_ctrl_reconnect_delay_store(struct device *dev,
>   	if (err)
>   		return err;
>   
> +	if (!v)
> +		return -EINVAL;
> +
>   	ctrl->opts->reconnect_delay = v;
>   	return count;
>   }

Reviewed-by: Hannes Reinecke <hare at kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich