Skip to content

Commit

Permalink
cifs: Fix integer overflow while processing actimeo mount option
Browse files Browse the repository at this point in the history
User-provided mount parameter actimeo of type u32 is intended to have
an upper limit, but before it is validated, the value is converted from
seconds to jiffies which can lead to an integer overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 6d20e84 ("cifs: add attribute cache timeout (actimeo) tunable")
Signed-off-by: Murad Masimov <m.masimov@mt-integration.ru>
Signed-off-by: Steve French <stfrench@microsoft.com>
  • Loading branch information
Murad Masimov authored and Steve French committed Mar 13, 2025
1 parent 5b29891 commit 64f690e
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion fs/smb/client/fs_context.c
Original file line number Diff line number Diff line change
Expand Up @@ -1358,7 +1358,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
ctx->acdirmax = HZ * result.uint_32;
break;
case Opt_actimeo:
if (HZ * result.uint_32 > CIFS_MAX_ACTIMEO) {
if (result.uint_32 > CIFS_MAX_ACTIMEO / HZ) {
cifs_errorf(fc, "timeout too large\n");
goto cifs_parse_mount_err;
}
Expand Down

0 comments on commit 64f690e

Please sign in to comment.