[PATCH] nbd: clamp the timeout before converting it to jiffies
Tao Cui <[email protected]>
| Newsgroups | org.kernel.vger.linux-block,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
From: Tao Cui <[email protected]> nbd_set_cmd_timeout() stores timeout * HZ into tag_set.timeout, an unsigned int, and passes the same product to blk_queue_rq_timeout() without any range check. A large timeout (2^32 seconds, say) truncates to 0 instead of being a very long timeout. Clamp the timeout to UINT_MAX / HZ seconds first. Setting NBD_SET_TIMEOUT to 2^32 left the debugfs timeout at 0 before this change and at 4294967000 after it. Fixes: 55313e92bd17 ("nbd: add set cmd timeout helper") Signed-off-by: Tao Cui <[email protected]> --- drivers/block/nbd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8f10762e90ef..1874c1a81d3a 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1619,6 +1619,10 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd) static void nbd_set_cmd_timeout(struct nbd_device *nbd, u64 timeout) { + /* clamp so that timeout * HZ fits in an unsigned int */ + if (timeout > UINT_MAX / HZ) + timeout = UINT_MAX / HZ; + nbd->tag_set.timeout = timeout * HZ; if (timeout) blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ); -- 2.43.0