From 33bd54009218a6ed4f7f8a1ab9fda9e98e705bcb Mon Sep 17 00:00:00 2001 From: Tao Cui Date: Mon, 17 Aug 2026 22:10:27 +0800 Subject: [PATCH] nbd: clamp the timeout before converting it to jiffies nbd_set_cmd_timeout() stores timeout * HZ into tag_set.timeout, an unsigned int, and passes the same product to blk_queue_rq_timeout() without any range check. A large timeout (2^32 seconds, say) truncates to 0 instead of being a very long timeout. Clamp the timeout to UINT_MAX / HZ seconds first. Setting NBD_SET_TIMEOUT to 2^32 left the debugfs timeout at 0 before this change and at 4294967000 after it. Fixes: 55313e92bd17 ("nbd: add set cmd timeout helper") Signed-off-by: Tao Cui Reviewed-by: Yu Kuai --- drivers/block/nbd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8f10762e90ef7..1874c1a81d3aa 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1619,6 +1619,10 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd) static void nbd_set_cmd_timeout(struct nbd_device *nbd, u64 timeout) { + /* clamp so that timeout * HZ fits in an unsigned int */ + if (timeout > UINT_MAX / HZ) + timeout = UINT_MAX / HZ; + nbd->tag_set.timeout = timeout * HZ; if (timeout) blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ);