Re: [PATCH] dlm: add usercopy whitelist to dlm_cb cache

Alexander Aring <[email protected]> Thu, 12 Feb 2026 08:33:40 -0500

Newsgroups	dev.linux.lists.gfs2,org.kernel.vger.linux-kernel
Message-ID	<CAK-6q+jySOc8qWJD+8oVXojf_T5L3qSB+Tt-q1gdZSnm6a=wxQ@mail.gmail.com>

Hi,

On Wed, Feb 11, 2026 at 10:43 PM Ziyi Guo <[email protected]> wrote:
>
> The dlm_cb slab cache is created with kmem_cache_create(), which
> provides no usercopy whitelist. When a callback carries LVB data,
> dlm_user_add_ast() copies the LVB into the inline lvbptr[] array within
> the slab-allocated struct dlm_callback and redirects ua->lksb.sb_lvbptr
> to point to it. copy_result_to_user() then calls copy_to_user() with
> this pointer. With CONFIG_HARDENED_USERCOPY enabled, this triggers
> usercopy_abort().
>
> Switch to kmem_cache_create_usercopy() with a whitelist covering the
> lvbptr field.
>
> Signed-off-by: Ziyi Guo <[email protected]>

Acked-by: Alexander Aring <[email protected]>

Thanks for pointing this out.

- Alex