Re: [PATCH v2] dlm: fix buffer overflow from negative len in dlm_search_rsb_tree

Hi,

On Tue, May 26, 2026 at 12:09=E2=80=AFPM Greg KH <[email protected]> wrote:
>
> On Tue, May 26, 2026 at 09:58:32AM -0400, Alexander Aring wrote:
> > Hi,
> >
> > On Mon, May 25, 2026 at 1:39=E2=80=AFPM Alexander Aring <aahringo@redha=
t.com> wrote:
> > >
> > > Hi,
> > >
> > > On Mon, May 25, 2026 at 10:27=E2=80=AFAM Alexander Aring <aahringo@re=
dhat.com> wrote:
> > > >
> > > > Hi,
> > > >
> > > > On Sat, May 16, 2026 at 10:03=E2=80=AFPM Joseph Qi <joseph.qi@linux=
.alibaba.com> wrote:
> > > > >
> > > > > commit 080e5563f878 only checks for len > DLM_RESNAME_MAXLEN, whi=
ch does
> > > >
> > > > check with checkpath, it reports an error regarding how this commit
> > > > reference is done.
> > > >
> > >
> > > This also addresses CVE-2026-43125 [0].
> > >
> > > - Alex
> > >
> > > [0] https://lore.kernel.org/linux-cve-announce/2026050619-CVE-2026-43=
125-c9f9@gregkh/
> >
> > cc the right folks [email protected] as described in the kernel documentat=
ion.
>
> For what?
>

because

"If the CVE assignment team misses a specific fix that any user feels
should have a CVE assigned to it, please email them at
<[email protected]> and the team there will work with you on it." [0]

The initial fix did not resolve CVE-2026-43125, there are additional
changes are required.

> > There is another patch required for CVE-2026-43125 [0].
> >
> > Joseph I think for v3 you should cc also [email protected] and mention
> > this in your commit msg.
>
> Why doesn't this deserve a different CVE id when it lands in the public
> trees?
>

because the vulnerability described in CVE-2026-43125 is the same, I'm
also not sure I cc "[email protected]" that the team there will work with
me on it as the kernel doc told me. :)

thanks.

- Alex

[0] https://docs.kernel.org/process/cve.html