Skip to contentSkip to conversation

scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store

PATCH Applied [email protected] 3 participants 3 messages Oct 26 – Oct 31

Subsystems (3)
SCSI SCSI target SCSI target core user driver
lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store

From: Shao Mingyin <[email protected]>

tcmu_set_data_pages_per_blk() only validates the upper bound of the value parsed from data_pages_per_blk=. Zero passes that check and is then used as the divisor when computing udev->max_blocks:

divide error: 0000 [#1] SMP
...
tcmu_set_data_pages_per_blk
tcmu_configure_device

Reject non-positive values, as the neighbouring max_data_area_mb and cmd_ring_size setters already do.

Fixes 08976cb548d6 ("scsi: target: tcmu: Make data_pages_per_blk changeable via configfs")
Signed-off-by Shao Mingyin <[email protected]>
Cc [email protected]

---

drivers/target/target_core_user.c +5 -0
index 425ad1246a75..07b514678176 100644
@@ -2524,6 +2524,11 @@ static int tcmu_set_data_pages_per_blk(struct tcmu_dev *udev, substring_t *arg)
 		return ret;
 	}
 
+	if (val <= 0) {
+		pr_err("Invalid data_pages_per_blk %d.\n", val);
+		return -EINVAL;
+	}
+
 	if (val > TCMU_MBS_TO_PAGES(udev->data_area_mb)) {
 		pr_err("Invalid data_pages_per_blk %d: greater than max_data_area_mb %d -> %zd pages).\n",
 		       val, udev->data_area_mb,
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 24 lines · On 26/10/2026 12:52, [email protected] wrote:

From: Shao Mingyin <[email protected]>

tcmu_set_data_pages_per_blk() only validates the upper bound of the value parsed from data_pages_per_blk=. Zero passes that check and is then used as the divisor when computing udev->max_blocks:

   divide error: 0000 [#1] SMP
   ...
   tcmu_set_data_pages_per_blk
   tcmu_configure_device

Reject non-positive values, as the neighbouring max_data_area_mb and cmd_ring_size setters already do.

Fixes 08976cb548d6 ("scsi: target: tcmu: Make data_pages_per_blk changeable via configfs")
Signed-off-by Shao Mingyin <[email protected]>
Cc [email protected]

---

drivers/target/target_core_user.c +0 -0
index 425ad1246a75..07b514678176 100644
@@ -2524,6 +2524,11 @@ static int tcmu_set_data_pages_per_blk(struct tcmu_dev *udev, substring_t *arg)
  		return ret;

drivers/target/target_core_user.c static int tcmu_set_data_pages_per_blk(struct tcmu_dev *udev, substring_t *arg) · line 2534

Quoted 10 lines
drivers/target/target_core_user.c +5 -0
  	}
 
+	if (val <= 0) {
+		pr_err("Invalid data_pages_per_blk %d.\n", val);
+		return -EINVAL;
+	}
+
  	if (val > TCMU_MBS_TO_PAGES(udev->data_area_mb)) {
  		pr_err("Invalid data_pages_per_blk %d: greater than max_data_area_mb %d -> %zd pages).\n",
  		       val, udev->data_area_mb,
Reviewed-by Bodo Stroesser <[email protected]>

Thank you.

Regards,
Bodo Stroesser

maintainer Applied
#2 lore raw
In reply to [email protected]
Quoted 4 lines

tcmu_set_data_pages_per_blk() only validates the upper bound of the value parsed from data_pages_per_blk=. Zero passes that check and is then used as the divisor when computing udev->max_blocks:

Applied to 7.4/scsi-staging, thanks!

Signature · 1 line
Martin K. Petersen