[PATCH 2/2] nvme-fabrics: bound keep_alive_tmo to avoid overflow

[Martin George <martinus.gpy@gmail.com>]

keep_alive_tmo (kato) is only checked for being negative, yet it is sent
to the controller as "kato * 1000" ms and used as "kato * HZ" jiffies for
the keep-alive timer; a large value overflows both.

Reject values above INT_MAX / 1000, which (as 1000 >= HZ) covers both
conversions, as the target already does via NVMET_MAX_KATO.

Signed-off-by: Martin George <marting@netapp.com>
---
 drivers/nvme/host/fabrics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index 25029978b978..b4ca0f9fd703 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -837,7 +837,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts,
 				goto out;
 			}
 
-			if (token < 0) {
+			if (token < 0 || token > INT_MAX / 1000) {
 				pr_err("Invalid keep_alive_tmo %d\n", token);
 				ret = -EINVAL;
 				goto out;
-- 
2.53.0