[PATCH] scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store

[PATCH] scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

tcmu_set_data_pages_per_blk() only validates the upper bound of the value
parsed from data_pages_per_blk=. Zero passes that check and is then used
as the divisor when computing udev->max_blocks:

  divide error: 0000 [#1] SMP
  ...
  tcmu_set_data_pages_per_blk
  tcmu_configure_device

Reject non-positive values, as the neighbouring max_data_area_mb and
cmd_ring_size setters already do.

Fixes: 08976cb548d6 ("scsi: target: tcmu: Make data_pages_per_blk changeable via configfs")
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
Cc: stable@vger.kernel.org
---
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 425ad1246a75..07b514678176 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -2524,6 +2524,11 @@ static int tcmu_set_data_pages_per_blk(struct tcmu_dev *udev, substring_t *arg)
 		return ret;
 	}

+	if (val <= 0) {
+		pr_err("Invalid data_pages_per_blk %d.\n", val);
+		return -EINVAL;
+	}
+
 	if (val > TCMU_MBS_TO_PAGES(udev->data_area_mb)) {
 		pr_err("Invalid data_pages_per_blk %d: greater than max_data_area_mb %d -> %zd pages).\n",
 		       val, udev->data_area_mb,

Re: [PATCH] scsi: target: tcmu: Fix divide-by-zero in data_pages_per_blk store

[Bodo Strößer]

On 26/10/2026 12:52, shao.mingyin@zte.com.cn wrote:

> From: Shao Mingyin <shao.mingyin@zte.com.cn>
>
> tcmu_set_data_pages_per_blk() only validates the upper bound of the value
> parsed from data_pages_per_blk=. Zero passes that check and is then used
> as the divisor when computing udev->max_blocks:
>
>    divide error: 0000 [#1] SMP
>    ...
>    tcmu_set_data_pages_per_blk
>    tcmu_configure_device
>
> Reject non-positive values, as the neighbouring max_data_area_mb and
> cmd_ring_size setters already do.
>
> Fixes: 08976cb548d6 ("scsi: target: tcmu: Make data_pages_per_blk changeable via configfs")
> Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
> Cc: stable@vger.kernel.org
> ---
> diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
> index 425ad1246a75..07b514678176 100644
> --- a/drivers/target/target_core_user.c
> +++ b/drivers/target/target_core_user.c
> @@ -2524,6 +2524,11 @@ static int tcmu_set_data_pages_per_blk(struct tcmu_dev *udev, substring_t *arg)
>   		return ret;
>   	}
>
> +	if (val <= 0) {
> +		pr_err("Invalid data_pages_per_blk %d.\n", val);
> +		return -EINVAL;
> +	}
> +
>   	if (val > TCMU_MBS_TO_PAGES(udev->data_area_mb)) {
>   		pr_err("Invalid data_pages_per_blk %d: greater than max_data_area_mb %d -> %zd pages).\n",
>   		       val, udev->data_area_mb,

Reviewed-by: Bodo Stroesser <bostroesser@gmail.com>

Thank you.

Regards,
Bodo Stroesser