Re: [PATCH] dlm: check negative length in dlm_search_rsb_tree

Alexander Aring <[email protected]> Fri, 15 May 2026 09:30:37 -0400

Newsgroups	dev.linux.lists.gfs2,org.kernel.vger.linux-kernel
Message-ID	<CAK-6q+iOFTdw0caweFQ7tw_amBHzW5xXM+H0_FicBAkHVz5OKA@mail.gmail.com>

Hi,

On Fri, May 15, 2026 at 3:39 AM Joseph Qi <[email protected]> wrote:
>
> commit 080e5563f878 only checks for len > DLM_RESNAME_MAXLEN, which does
> not catch negative values. While the input 'len' can be negative and a
> negative int passed to memcpy() is implicitly converted to a large
> size_t, causing a stack buffer overflow on the key[] array.
>
> Fix this by also rejecting len <= 0.

or change the parameter to unsigned?

- Alex