Re: [PATCH] nbd: clamp the timeout before converting it to jiffies

在 2026/8/17 22:10, Tao Cui 写道:

> From: Tao Cui<[email protected]>
>
> nbd_set_cmd_timeout() stores timeout * HZ into tag_set.timeout, an
> unsigned int, and passes the same product to blk_queue_rq_timeout()
> without any range check.  A large timeout (2^32 seconds, say)
> truncates to 0 instead of being a very long timeout.
>
> Clamp the timeout to UINT_MAX / HZ seconds first.
>
> Setting NBD_SET_TIMEOUT to 2^32 left the debugfs timeout at 0 before
> this change and at 4294967000 after it.
>
> Fixes: 55313e92bd17 ("nbd: add set cmd timeout helper")
> Signed-off-by: Tao Cui<[email protected]>
> ---
>   drivers/block/nbd.c | 4 ++++
>   1 file changed, 4 insertions(+)
Reviewed-by: Yu Kuai <[email protected]>

-- 
Thanks,
Kuai