[PATCH] nfs/blocklayout: reject stripe volume with zero chunk_size

[PATCH] nfs/blocklayout: reject stripe volume with zero chunk_size

[Liu Chao]

bl_parse_stripe() copies v->stripe.chunk_size from the volume
descriptor supplied by the server into d->chunk_size without any
validation.  bl_map_stripe() later divides the block offset by
d->chunk_size, so a malicious or broken server that advertises a
stripe volume with chunk_size == 0 triggers a divide error in the
kernel and crashes the client.

Reject the volume at parse time when chunk_size is zero, before the
value is stored, so the deviceid node allocation fails cleanly with
-EIO instead of faulting later.

Reviewed-by: Guo Zihao <guozh23@xiaopeng.com>
Signed-off-by: Liu Chao <liuc63@xiaopeng.com>
---
 fs/nfs/blocklayout/dev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
index 134d7f760..6203052e0 100644
--- a/fs/nfs/blocklayout/dev.c
+++ b/fs/nfs/blocklayout/dev.c
@@ -505,6 +505,9 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d,
 		len += d->children[i].len;
 	}
 
+	if (!v->stripe.chunk_size)
+		return -EINVAL;
+
 	d->len = len;
 	d->chunk_size = v->stripe.chunk_size;
 	d->map = bl_map_stripe;
-- 
2.50.1

Re: [PATCH] nfs/blocklayout: reject stripe volume with zero chunk_size

[Christoph Hellwig]

On Fri, Oct 16, 2026 at 12:11:39PM +0800, Liu Chao wrote:
> bl_parse_stripe() copies v->stripe.chunk_size from the volume
> descriptor supplied by the server into d->chunk_size without any
> validation.  bl_map_stripe() later divides the block offset by
> d->chunk_size, so a malicious or broken server that advertises a
> stripe volume with chunk_size == 0 triggers a divide error in the
> kernel and crashes the client.
> 
> Reject the volume at parse time when chunk_size is zero, before the
> value is stored, so the deviceid node allocation fails cleanly with
> -EIO instead of faulting later.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>