mirror of
https://github.com/torvalds/linux.git
synced 2026-09-24 06:24:02 +02:00
b54e03d9b3
A node receiving a DLM_MIG_LOCKRES message trusts several fields of the
peer-supplied dlm_migratable_lockres without validation. num_locks and
lockname_len are bounded only on the sending side, and the message is
never checked to actually carry num_locks migratable_lock entries. As a
result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the
kmalloc(data_len) copy of the message (an out-of-bounds read that ends in
a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the
fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write).
Both are reachable by any node in the domain.
Validate these fields right after dlm_grab(), before anything uses them --
including the not-joined error path, which already prints mres->lockname
with the unbounded lockname_len as a %.*s precision. Reject the message
unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <=
DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the
payload is large enough to hold the claimed locks. Conforming recovery
and migration messages are unaffected.
Link: https://lore.kernel.org/20260629-b4-disp-94fb6521-v1-2-6953bcc0421f@proton.me
Fixes:
|
||
|---|---|---|
| .. | ||
| dlmapi.h | ||
| dlmast.c | ||
| dlmcommon.h | ||
| dlmconvert.c | ||
| dlmconvert.h | ||
| dlmdebug.c | ||
| dlmdebug.h | ||
| dlmdomain.c | ||
| dlmdomain.h | ||
| dlmlock.c | ||
| dlmmaster.c | ||
| dlmrecovery.c | ||
| dlmthread.c | ||
| dlmunlock.c | ||
| Makefile | ||