diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index a05e1eb2c3fd121e265d4a38ad55b5cfa2e39545..15f4e6d34fdd0160522e8a807948a8017436f800 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2068,6 +2068,15 @@ static int nfs23_validate_mount_data(void *options,
 			memset(mntfh->data + mntfh->size, 0,
 			       sizeof(mntfh->data) - mntfh->size);
 
+		/*
+		 * for proto == XPRT_TRANSPORT_UDP, which is what uses
+		 * to_exponential, implying shift: limit the shift value
+		 * to BITS_PER_LONG (majortimeo is unsigned long)
+		 */
+		if (!(data->flags & NFS_MOUNT_TCP)) /* this will be UDP */
+			if (data->retrans >= 64) /* shift value is too large */
+				goto out_invalid_data;
+
 		/*
 		 * Translate to nfs_parsed_mount_data, which nfs_fill_super
 		 * can deal with.
@@ -2168,6 +2177,10 @@ static int nfs23_validate_mount_data(void *options,
 out_invalid_fh:
 	dfprintk(MOUNT, "NFS: invalid root filehandle\n");
 	return -EINVAL;
+
+out_invalid_data:
+	dfprintk(MOUNT, "NFS: invalid binary mount data\n");
+	return -EINVAL;
 }
 
 #if IS_ENABLED(CONFIG_NFS_V4)