From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=203.205.221.192 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793103218; b=3sx7RezaPb01gssf6bFf/y8LFCYRgiLfmsIy3fpTWZIDl1T6y31teDQJ/boRiu9iXsyb KVbYwsiryH4YMbfvemEwAWDl8D91c1Vk4oItg3TN/OTJauHMUs4qciLF9GOFINITx1HBf SRyEJlcfMKQrJYMUghrT2BrNiez4+S3xM0IZaRv5g9mFBMFpipDiPXYP9DR6L8p83itiH ueGFTkFyXVvLloGnEp05WYr/HkCa7g8aVbg5EAMlP/jNNhVGWt9efuJ+zfj226UeM/AT/ x3t1hR19Cqv5s5k1TBbaMgNrYEzZt0PKQ4cGrvsA4UnIcn3Vb6ByNbwODTwz5HNRddA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793103218; h=DMARC-Filter:DKIM-Signature:Received:X-QQ-mid:Message-ID: X-QQ-XMAILINFO:X-QQ-XMRINFO:From:To:Cc:Subject:Date:X-OQ-MSGID: X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=2VXJ9XM97iLQduVg3UEnKJt/vf1Pmk/r9gbTiERY3d0=; b=y7YnEBPAQsOZRsQyXtwtcJv/kpiQcIChIZKHgZKx+9Qaj/Hkof82wVd32v6H743tk/UR PZDoqdprXnXbtJVinksjoPHj95xE9znmdlYAEdwB/uMPDe4iPxeg9Fn7ekWoFxO8FhcW1 onMDggmq5faPhj2Kw2+vZypCDa8QR0pY35UKNcoROPYGYO00KRM5tXTmCEq2eMJMC+Zci Tg/XriLacGIBO+4absdmzuh3aDqp+P5Qy+cQWKMB9G/3Nh1CXWbUcWf0M6fG9S+tGVE6p DJ0YJFcdnCZ9fkmDJz5MvVIk9fFMq2QKxSOL8TbiFKbHKGDMYArKtDNeAttGZaM7S8A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass header.d=qq.com header.i=@qq.com header.a=rsa-sha256 header.s=s201512 header.b=F+Zzpd8m; arc=none smtp.remote-ip=203.205.221.192 Received: from out203-205-221-192.mail.qq.com (out203-205-221-192.mail.qq.com [203.205.221.192]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B3B5606A33A; Tue, 27 Oct 2026 12:13:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 5B3B5606A33A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=qq.com header.i=@qq.com header.a=rsa-sha256 header.s=s201512 header.b=F+Zzpd8m DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1793103213; bh=2VXJ9XM97iLQduVg3UEnKJt/vf1Pmk/r9gbTiERY3d0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=F+Zzpd8mhSVLCSIMCbbCMTqGZL0NLkJPj62aNWNxIlTcnH4eIh8KWjGK83/LDCChn pfnzuQxQYXyiPHwHyLbZO0VIQLoXl9CGUyU9J7IVEnZyu5CDyspyyO8yhf5Ck/jUfg OtsqHzArPE9XJj3AoVUQu1YNKNPCppYYcRYHiQVs= Received: from kernel-lab.tail5e91bb.ts.net ([2409:8950:57d:63:2e7f:4b13:c1e3:e391]) by newxmesmtplogicsvrsza53-0.qq.com (NewEsmtp) with SMTP id 35D23E21; Tue, 27 Oct 2026 20:13:29 +0800 X-QQ-mid: xmsmtpt1793103211txq685nwy Message-ID: X-QQ-XMAILINFO: NA8WCMn5GQiMy+zlO8CCuCFhNxcKbk3YTqLyzQkl9E56TpW6qghg03O7kczzEv lItanb9j8biCCfSDzqJcA7chTemFZvQ/UNmVglMulBCJxNb3nLTPaLMU++tCsMBtksTC5R6jpg4d /l34BeyWMpN4jGKHp8MEMnpQFeiD0nAmATv40N+AXiAybR11A4pWb6+qHV/UFD2KR4B6t+myVL26 VSjDVhzU7rZB1oOWMRxCTXY6H6obnsw9MEZ65i/E+l1uuf6FtUeK/kPmPKg1qJsjE0iL4rShfDYT h/ULjj3BsSEuqjDoaZEjP1DaGwcleaJMzT1cXAGmnqvgjtx927iq2Ia+QmidnDvfOwxu2vf2KWwD PwTMMfVdfoRmgcWjTULXck38tNG3oNCyMXdNhu5BBFcZuIor4BBXL0t1nfciT3Np90l/+xbgFbbc Mb5/akVV0F4vQuFHoueek9207HQlHCOFvcnG2s7HdZLNjZlEnp78ak1R9uBy9wQHui+QxxsM18T4 UNTTbLk6pss4iAQQUA4SqN9dSK+cOAgPqaoN3NRCvzLXuuazJ7mPRzN0V13iLRL4btdGA22ZI8Rq 8N9OJBHBd6hB/FXZ0JQuVO3/UCv4M4krf5ji1inRjOp6FD8Z7t4ylsCVAvyXvuKZ7lt6qY6xzuj8 IBeveK7ymqM2Abm89H4QVPloGsb88VXlFydNIYx0zQ4b9qx4w74UO4hkjuakDkCk++lnTiiGpeXW qrZzCSsAW+Ud4ZM5fq7CSnlsG/cFIyfmpeMYIHLc529GNvo08e/F2T6KV+9P/MRAHPp8R+2iF9NX IZgSLxRl/ZrOpeQ13EF9DPVrnS9JA9ydFTLTqsR7I6q7fF8NywScnDEHK/PSKvYKIew8JYEqSDSo 3coOr6RNZKCsC8q1lcZEULkyknjzTP93bZhpPG4TDuDO+qL3hGgrZLLTxkmTGUcin6+2x79UBWY+ Wx4XLSoMyfPsnxSmrzguJy4jGmeHhgOaap5Zi3nIXgSOaGyCKy8j7+8+w9u1h/MIbreoxbpeT3Ey aEiNGvIn0zS8SDtGBjMydqDTA7mDz7ZKwkzYCC0AC4hh0DuKSFqVv6AHuiuyydn8GaToWWzqNJ4Z OWYk4d8QQGzQCY9AIf6/VKTJrxJOSf0a6gwthTuxVzdnZScn0= X-QQ-XMRINFO: NyFYKkN4Ny6FuXrnB5Ye7Aabb3ujjtK+gg== From: Yingjie Wang <1075151112@qq.com> To: linux-nvme@lists.infradead.org Cc: kbusch@kernel.org, axboe@kernel.dk, hch@lst.de, sagi@grimberg.me, kch@nvidia.com, hare@suse.de, corbet@lwn.net, skhan@linuxfoundation.org, rdunlap@infradead.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/2] nvmet-tcp: validate the TLS handshake timeout Date: Tue, 27 Oct 2026 20:13:28 +0800 X-OQ-MSGID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tls_handshake_timeout is writable but stored as a signed int. Multiplying the value by MSEC_PER_SEC and HZ therefore uses signed arithmetic. With HZ=1000, setting it to 2147484 overflows both multiplications. If the handshake request is accepted and remains pending, the timer wheel treats the jiffies delay as already expired and queues the timeout work on its next advance, while the handshake agent was given about 24.9 days. Negative values such as -1 cause the same immediate kernel-side timeout. Store the parameter as an unsigned int and reject values that cannot be represented both by tls_handshake_args::ta_timeout_ms and by a safe jiffies delay. Take one snapshot so a concurrent parameter update cannot give the handshake agent and delayed work different timeouts. Document the accepted range for built-in use. Negative and oversized values now fail with -EINVAL. Keep zero valid, preserving the existing immediate-timeout behavior. Fixes: 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall") Cc: stable@vger.kernel.org Signed-off-by: Yingjie Wang <1075151112@qq.com> --- .../admin-guide/kernel-parameters.txt | 5 ++++ drivers/nvme/target/tcp.c | 26 ++++++++++++++++--- 2 files changed, 27 insertions(+), 4 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 68647ff4bdd24..cc54d5f169f67 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -4801,6 +4801,11 @@ Kernel parameters Example: nvme.quirks=7710:2267:bogus_nid,^identify_cns-9900:7711:broken_msi + nvmet_tcp.tls_handshake_timeout= + [NVME] TLS handshake timeout in seconds. Valid values + range from 0 to the smaller of UINT_MAX / 1000 and + MAX_JIFFY_OFFSET / HZ. Default: 10 + ohci1394_dma=early [HW,EARLY] enable debugging via the ohci1394 driver. See Documentation/core-api/debugging-via-ohci1394.rst for more info. diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index e598101752620..7937377436d3b 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -6,6 +6,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -76,8 +77,24 @@ MODULE_PARM_DESC(idle_poll_period_usecs, /* * TLS handshake timeout */ -static int tls_handshake_timeout = 10; -module_param(tls_handshake_timeout, int, 0644); +static unsigned int tls_handshake_timeout = 10; + +static int tls_handshake_timeout_set(const char *val, + const struct kernel_param *kp) +{ + return param_set_uint_minmax(val, kp, 0, + min_t(unsigned long, UINT_MAX / MSEC_PER_SEC, + MAX_JIFFY_OFFSET / HZ)); +} + +static const struct kernel_param_ops tls_handshake_timeout_ops = { + .set = tls_handshake_timeout_set, + .get = param_get_uint, +}; + +module_param_cb(tls_handshake_timeout, &tls_handshake_timeout_ops, + &tls_handshake_timeout, 0644); +__MODULE_PARM_TYPE(tls_handshake_timeout, "uint"); MODULE_PARM_DESC(tls_handshake_timeout, "nvme TLS handshake timeout in seconds (default 10)"); #endif @@ -1904,6 +1921,7 @@ static int nvmet_tcp_tls_handshake(struct nvmet_tcp_queue *queue) { int ret = -EOPNOTSUPP; struct tls_handshake_args args; + unsigned int timeout = READ_ONCE(tls_handshake_timeout); if (queue->state != NVMET_TCP_Q_TLS_HANDSHAKE) { pr_warn("cannot start TLS in state %d\n", queue->state); @@ -1917,7 +1935,7 @@ static int nvmet_tcp_tls_handshake(struct nvmet_tcp_queue *queue) args.ta_done = nvmet_tcp_tls_handshake_done; args.ta_data = queue; args.ta_keyring = key_serial(queue->port->nport->keyring); - args.ta_timeout_ms = tls_handshake_timeout * 1000; + args.ta_timeout_ms = timeout * MSEC_PER_SEC; ret = tls_server_hello_psk(&args, GFP_KERNEL); if (ret) { @@ -1925,7 +1943,7 @@ static int nvmet_tcp_tls_handshake(struct nvmet_tcp_queue *queue) pr_err("failed to start TLS, err=%d\n", ret); } else { queue_delayed_work(nvmet_wq, &queue->tls_handshake_tmo_work, - tls_handshake_timeout * HZ); + (unsigned long)timeout * HZ); } return ret; } -- 2.43.0