Re: [PATCH v2 2/2] nvme-tcp: validate the TLS handshake timeout

[Hannes Reinecke]

On 10/27/26 1:13 PM, Yingjie Wang wrote:
> tls_handshake_timeout is writable but stored as a signed int. Multiplying
> the value by MSEC_PER_SEC and HZ therefore uses signed arithmetic.
>
> With HZ=1000, setting it to 2147484 overflows both multiplications. If
> the handshake request is accepted and its completion remains pending,
> schedule_timeout() reports a wrong timeout value with a stack dump and
> returns zero. The handshake then fails immediately with -ETIMEDOUT,
> while the handshake agent was given about 24.9 days. Negative values
> such as -1 have the same kernel-side effect.
>
> Store the parameter as an unsigned int and reject values that cannot be
> represented both by tls_handshake_args::ta_timeout_ms and by a safe
> jiffies delay. Take one snapshot so a concurrent parameter update cannot
> give the handshake agent and completion wait different timeouts.
> Document the accepted range for built-in use.
>
> wait_for_completion_interruptible_timeout() returns the remaining
> jiffies as a long after a successful completion. Keep that result in a
> long because an accepted timeout can exceed INT_MAX jiffies on 64-bit
> systems.
>
> Negative and oversized values now fail with -EINVAL. Keep zero valid,
> preserving the existing immediate-timeout behavior.
>
> Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yingjie Wang <1075151112@xxxxxx>
> ---
>   .../admin-guide/kernel-parameters.txt         |  5 +++
>   drivers/nvme/host/tcp.c                       | 34 ++++++++++++++-----
>   2 files changed, 31 insertions(+), 8 deletions(-)
Reviewed-by: Hannes Reinecke <hare@xxxxxxxxxx>

Cheers,

Hannes
--
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@xxxxxxx                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich