[PATCH v2 1/2] nvmet-tcp: validate the TLS handshake timeout

[Hannes Reinecke]

On 10/27/26 1:13 PM, Yingjie Wang wrote:
> tls_handshake_timeout is writable but stored as a signed int. Multiplying
> the value by MSEC_PER_SEC and HZ therefore uses signed arithmetic.
> 
> With HZ=1000, setting it to 2147484 overflows both multiplications. If
> the handshake request is accepted and remains pending, the timer wheel
> treats the jiffies delay as already expired and queues the timeout work
> on its next advance, while the handshake agent was given about 24.9
> days. Negative values such as -1 cause the same immediate kernel-side
> timeout.
> 
> Store the parameter as an unsigned int and reject values that cannot be
> represented both by tls_handshake_args::ta_timeout_ms and by a safe
> jiffies delay. Take one snapshot so a concurrent parameter update cannot
> give the handshake agent and delayed work different timeouts. Document
> the accepted range for built-in use.
> 
> Negative and oversized values now fail with -EINVAL. Keep zero valid,
> preserving the existing immediate-timeout behavior.
> 
> Fixes: 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall")
> Cc: stable at vger.kernel.org
> Signed-off-by: Yingjie Wang <1075151112 at qq.com>
> ---
>   .../admin-guide/kernel-parameters.txt         |  5 ++++
>   drivers/nvme/target/tcp.c                     | 26 ++++++++++++++++---
>   2 files changed, 27 insertions(+), 4 deletions(-)
> 
Reviewed-by: Hannes Reinecke <hare at kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich