From: Tao Cui <cuitao@kylinos.cn>

nbd_set_cmd_timeout() stores timeout * HZ into tag_set.timeout, an
unsigned int, and passes the same product to blk_queue_rq_timeout()
without any range check.  A large timeout (2^32 seconds, say)
truncates to 0 instead of being a very long timeout.

Clamp the timeout to UINT_MAX / HZ seconds first.

Setting NBD_SET_TIMEOUT to 2^32 left the debugfs timeout at 0 before
this change and at 4294967000 after it.

Fixes: 55313e92bd17 ("nbd: add set cmd timeout helper")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 drivers/block/nbd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 8f10762e90ef..1874c1a81d3a 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1619,6 +1619,10 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd)
 
 static void nbd_set_cmd_timeout(struct nbd_device *nbd, u64 timeout)
 {
+	/* clamp so that timeout * HZ fits in an unsigned int */
+	if (timeout > UINT_MAX / HZ)
+		timeout = UINT_MAX / HZ;
+
 	nbd->tag_set.timeout = timeout * HZ;
 	if (timeout)
 		blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ);
-- 
2.43.0

在 2026/8/17 22:10, Tao Cui 写道:

> From: Tao Cui<cuitao@kylinos.cn>
>
> nbd_set_cmd_timeout() stores timeout * HZ into tag_set.timeout, an
> unsigned int, and passes the same product to blk_queue_rq_timeout()
> without any range check.  A large timeout (2^32 seconds, say)
> truncates to 0 instead of being a very long timeout.
>
> Clamp the timeout to UINT_MAX / HZ seconds first.
>
> Setting NBD_SET_TIMEOUT to 2^32 left the debugfs timeout at 0 before
> this change and at 4294967000 after it.
>
> Fixes: 55313e92bd17 ("nbd: add set cmd timeout helper")
> Signed-off-by: Tao Cui<cuitao@kylinos.cn>
> ---
>   drivers/block/nbd.c | 4 ++++
>   1 file changed, 4 insertions(+)
Reviewed-by: Yu Kuai <yukuai@fygo.io>

-- 
Thanks,
Kuai