[PATCH] nvmet: reject keep-alive timeouts that would overflow

[Keith Busch]

On Fri, Oct 30, 2026 at 04:46:22PM +0800, Yingjie Wang wrote:
> nvmet_set_feat_kato() and nvmet_alloc_ctrl() convert the 32-bit
> millisecond KATO from the host to seconds with DIV_ROUND_UP(kato, 1000).
> The addition in DIV_ROUND_UP() is done in 32 bits, so any KATO above
> 4294966296 ms wraps around and rounds to 0 seconds. A Set Features
> command with KATO 0xffffffff then succeeds but disables the keep-alive
> timer: Get Features returns 0 and Keep Alive fails with Keep Alive
> Timeout Invalid. A Connect command with such a KATO creates a controller
> without a keep-alive timer.
> 
> The converted value has more consumers that can overflow. Get Features
> multiplies it by 1000, and the timer paths multiply it by HZ in 32 bits
> and arm a delay that must not exceed MAX_JIFFY_OFFSET.
> 
> Reject a KATO whose rounded value does not fit all of these. Return Keep
> Alive Timeout Invalid from both Set Features and Connect. Validate Set
> Features before stopping the current timer so a failed update leaves its
> timeout unchanged. Round in 64 bits. A KATO of 0 keeps its current
> meaning.

Thanks, applied to nvme-7.4.