[PATCH] nvme: reject invalid reconnect_delay sysfs values

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@xxxxxxxxxx>

nvme_ctrl_reconnect_delay_store() stores whatever kstrtou32() accepted
into opts->reconnect_delay without validating it.  The nvme-fabrics
option parser refuses reconnect_delay values that are zero or negative,
and the rest of the driver relies on that: nvme_ctrl_loss_tmo_store()
computes

	opts->max_reconnects = DIV_ROUND_UP(ctrl_loss_tmo,
					    opts->reconnect_delay);

Writing 0 to reconnect_delay and then a positive value to ctrl_loss_tmo
therefore divides by zero in the kernel.  In addition, a value larger
than INT_MAX is truncated to a negative int in the assignment and
silently bypasses the checks done by the fabrics parser.

Reject zero and values that do not fit into the signed int field.

Fixes: 764075fdcb2f ("nvme: expose reconnect_delay and ctrl_loss_tmo via sysfs")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
Tested on 7.3.0-next-20261030 (QEMU/TCG guest) with the loop transport.

Writing 0 to reconnect_delay and then a positive value to ctrl_loss_tmo
divides by zero in nvme_ctrl_loss_tmo_store():

  unpatched                            patched
  reconnect_delay=0 accepted           write rejected (-EINVAL)
  divide error, kernel panic

diff --git a/drivers/nvme/host/sysfs.c b/drivers/nvme/host/sysfs.c
index 10018c6356b6..d7309a55aa8a 100644
--- a/drivers/nvme/host/sysfs.c
+++ b/drivers/nvme/host/sysfs.c
@@ -634,6 +634,14 @@ static ssize_t nvme_ctrl_reconnect_delay_store(struct device *dev,
 	if (err)
 		return err;
 
+	/*
+	 * reconnect_delay is used as a divisor by nvme_ctrl_loss_tmo_store()
+	 * and the reconnect logic expects a positive value, just like the
+	 * nvme-fabrics option parser does.
+	 */
+	if (!v || v > INT_MAX)
+		return -EINVAL;
+
 	ctrl->opts->reconnect_delay = v;
 	return count;
 }