* sunrpc:fix shift-out-of-bounds for majortimeo
@ 2026-06-12 3:03 zhangjian (CG)
0 siblings, 0 replies; only message in thread
From: zhangjian (CG) @ 2026-06-12 3:03 UTC (permalink / raw)
To: chuck.lever, Jeff Layton, neil, okorniev, Dai.Ngo; +Cc: linux-nfs, linux-kernel
For UDP proto, to->to_exponential is true. Too large to_retries
may cause shift-out-of-bounds error for "majortime <<= to_retries"
Add sanity checks to fix it.
Signed-off-by: zhangjian <zhangjian496@huawei.com>
---
net/sunrpc/xprt.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 48a3618cbb29..c62f9998ffe9 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -656,10 +656,16 @@ static unsigned long xprt_calc_majortimeo(struct
rpc_rqst *req,
{
unsigned long majortimeo = req->rq_timeout;
- if (to->to_exponential)
- majortimeo <<= to->to_retries;
- else
+ if (to->to_exponential) {
+ if (to->to_retries >= BITS_PER_LONG ||
+ majortimeo > (ULONG_MAX >> to->to_retries)) {
+ majortimeo = ULONG_MAX;
+ } else {
+ majortimeo <<= to->to_retries;
+ }
+ } else {
majortimeo += to->to_increment * to->to_retries;
+ }
if (majortimeo > to->to_maxval || majortimeo == 0)
majortimeo = to->to_maxval;
return majortimeo;
--
2.33.0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-06-12 3:04 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-06-12 3:03 sunrpc:fix shift-out-of-bounds for majortimeo zhangjian (CG)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®