From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794046542; b=r3gJ5DDyzr/ZBdWnKFAME0xZ55qzhOxlbU7Vr0kG4Wt/LypNsFtuwSbqzCXRsWrJw6Jo ojK46NzT9TS1p1MOJu0EJN/GjyR/Rd45WUPLSKrD9fLKrCQocQ7CyeHEnmB2uzIZIuniF yLMyPPOT1ncXxBVqYNwwvtyBWYoTdoXDDl1+LHgnFL6xILmmbSDLa+US8d1vQKoN3i7Gb 8sEckhbWDVSUSp+x1LegobG8TBgYHxdyfgbk7Zx2zgrpV/FzbKCwVkqp9DwOEKKcdxYRE dfjLM+Jb9GCSxT+aBWyed1TObhSBM5DA3nV7nFGueohjwLP7FI3ssK8eJxCdxAfEcwQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794046542; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=BZuGa9bWlyLCcLwMLWbzjhBK/Mlj3DoQzNBxo1AbQNw=; b=hxyH7CWuJcx7iIzEu8B7kfJ4bBpYb3w8AUYmzqCI0vVZY6ZEqLKco//ZOnog9cFATxdr QB9bzsRIIxIBEz9U470X/kkVCVu2N3lVIRMyu+KG64P5PktDgGX8XL6LnfniN73M4HTpe S8dmfWaLwvLl/4xyF3LGe6OCx1ml1DFUknF1efSMLMZkSqpshJwkctvk1fcg3ubD4xXtc oHLASUSaQZBUO6+RS2bgfrirgreiHd9O6fhghHuXWJvuyqAUEQO7qO5V6BUYQac9AYmNY Alq5Kd4dtTN7JgBZqhxh2gFS0exQmNDtgHgm4WxPPjBiIibtM6o5ryBM6jsJ7xbGwTQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Wyd6pUcJ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 03C91606A32C for ; Sat, 7 Nov 2026 10:15:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=Wyd6pUcJ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4AC1B1F0089F; Sat, 7 Nov 2026 10:15:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794046541; bh=BZuGa9bWlyLCcLwMLWbzjhBK/Mlj3DoQzNBxo1AbQNw=; h=From:To:Cc:Subject:Date; b=Wyd6pUcJxH0Fsf+Yg4bxZ+plDYSndsbieDo74zXCamgait9DZO+gzIdq6UtkM+74L 20xe9vi1y4CD5y5w7iR9ySxteCMYrDj8/Q0RSSlaxA5wNmgnll72I+OzKkZW9BCuwz 6t8UoobTxGmwmytEYC9JYL5uDYJ4yDyDbw/P+5cNDlnC/4JiHqpFcxf2dsqp/n7UE6 4JplmHMAzhCd3IJ+79cmuOWVSoCNz7suIy0kAkMv/ihkqFknXzW3EzNFtyvC9e9kk6 UHJwBAqSCWrrg2wbdW0HpIi1WcDlG4bj03UNAgFhGQtSJS4nDGV1ZF08yIMoR/wZJ0 QdyyYnLpOyj0g== From: Sasha Levin To: 1075151112@qq.com, hare@kernel.org, hch@lst.de, kbusch@kernel.org Cc: stable@vger.kernel.org Subject: FAILED: patch "[PATCH] nvme-tcp: validate the TLS handshake timeout" failed to apply to 6.18-stable tree Date: Sat, 7 Nov 2026 05:15:40 -0500 Message-ID: <20261107051540-failed-6.18-799203afd298@kernel.org> X-Mailer: git-send-email 2.53.0 X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 799203afd298b1f8e9ee49815eb38f775f211299 # git commit -s git send-email --to '' --in-reply-to '20261107051540-failed-6.18-799203afd298@kernel.org' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Thanks, Sasha ------------------ original commit in Linus's tree ------------------ >From 799203afd298b1f8e9ee49815eb38f775f211299 Mon Sep 17 00:00:00 2001 From: Yingjie Wang <1075151112@qq.com> Date: Wed, 28 Oct 2026 19:57:20 +0800 Subject: [PATCH] nvme-tcp: validate the TLS handshake timeout tls_handshake_timeout is writable but stored as a signed int. Multiplying the value by MSEC_PER_SEC and HZ therefore uses signed arithmetic. With HZ=1000, setting it to 2147484 overflows both multiplications. If the handshake request is accepted and its completion remains pending, schedule_timeout() reports a wrong timeout value with a stack dump and returns zero. The handshake then fails immediately with -ETIMEDOUT, while the handshake agent was given about 24.9 days. Negative values such as -1 have the same kernel-side effect. Store the parameter as an unsigned int and reject values that cannot be represented both by tls_handshake_args::ta_timeout_ms and by a safe jiffies delay. Take one snapshot so a concurrent parameter update cannot give the handshake agent and completion wait different timeouts. Document the accepted range for built-in use. wait_for_completion_interruptible_timeout() returns the remaining jiffies as a long after a successful completion. Keep that result in a long because an accepted timeout can exceed INT_MAX jiffies on 64-bit systems. Negative and oversized values now fail with -EINVAL. Keep zero valid, preserving the existing immediate-timeout behavior. Fixes: be8e82caa685 ("nvme-tcp: enable TLS handshake upcall") Cc: stable@vger.kernel.org Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Yingjie Wang <1075151112@qq.com> Signed-off-by: Keith Busch --- .../admin-guide/kernel-parameters.txt | 5 +++ drivers/nvme/host/tcp.c | 34 ++++++++++++++----- 2 files changed, 31 insertions(+), 8 deletions(-) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index 5bd8a24be6b61..187917a4f196d 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -4801,6 +4801,11 @@ Kernel parameters Example: nvme.quirks=7710:2267:bogus_nid,^identify_cns-9900:7711:broken_msi + nvme_tcp.tls_handshake_timeout= + [NVME] NVMe/TCP host TLS handshake timeout in seconds. + Valid values range from 0 to the smaller of + UINT_MAX / 1000 and MAX_JIFFY_OFFSET / HZ. Default: 10 + nvmet_tcp.tls_handshake_timeout= [NVME] NVMe/TCP target TLS handshake timeout in seconds. Valid values range from 0 to the smaller of diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index e69e6535e1a17..a8e94e4866db2 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -6,6 +6,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include #include +#include #include #include #include @@ -48,9 +49,24 @@ MODULE_PARM_DESC(wq_unbound, "Use unbound workqueue for nvme-tcp IO context (def /* * TLS handshake timeout */ -static int tls_handshake_timeout = 10; +static unsigned int tls_handshake_timeout = 10; #ifdef CONFIG_NVME_TCP_TLS -module_param(tls_handshake_timeout, int, 0644); +static int tls_handshake_timeout_set(const char *val, + const struct kernel_param *kp) +{ + return param_set_uint_minmax(val, kp, 0, + min_t(unsigned long, UINT_MAX / MSEC_PER_SEC, + MAX_JIFFY_OFFSET / HZ)); +} + +static const struct kernel_param_ops tls_handshake_timeout_ops = { + .set = tls_handshake_timeout_set, + .get = param_get_uint, +}; + +module_param_cb(tls_handshake_timeout, &tls_handshake_timeout_ops, + &tls_handshake_timeout, 0644); +__MODULE_PARM_TYPE(tls_handshake_timeout, "uint"); MODULE_PARM_DESC(tls_handshake_timeout, "nvme TLS handshake timeout in seconds (default 10)"); #endif @@ -1946,8 +1962,10 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl, { int qid = nvme_tcp_queue_id(queue); int ret; + long wait_ret; struct tls_handshake_args args; - unsigned long tmo = tls_handshake_timeout * HZ; + unsigned int timeout = READ_ONCE(tls_handshake_timeout); + unsigned long tmo = (unsigned long)timeout * HZ; key_serial_t keyring = nvme_keyring_id(); dev_dbg(nctrl->device, "queue %d: start TLS with key %x\n", @@ -1961,7 +1979,7 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl, if (nctrl->opts->keyring) keyring = key_serial(nctrl->opts->keyring); args.ta_keyring = keyring; - args.ta_timeout_ms = tls_handshake_timeout * 1000; + args.ta_timeout_ms = timeout * MSEC_PER_SEC; queue->tls_err = -EOPNOTSUPP; init_completion(&queue->tls_complete); ret = tls_client_hello_psk(&args, GFP_KERNEL); @@ -1970,10 +1988,10 @@ static int nvme_tcp_start_tls(struct nvme_ctrl *nctrl, qid, ret); return ret; } - ret = wait_for_completion_interruptible_timeout(&queue->tls_complete, tmo); - if (ret <= 0) { - if (ret == 0) - ret = -ETIMEDOUT; + wait_ret = wait_for_completion_interruptible_timeout(&queue->tls_complete, + tmo); + if (wait_ret <= 0) { + ret = wait_ret < 0 ? -ERESTARTSYS : -ETIMEDOUT; dev_err(nctrl->device, "queue %d: TLS handshake failed, error %d\n", -- 2.53.0