[PATCH] dlm: reject wrapped messages with oversized inner lengths
Jérémy Jean <[email protected]>
| Newsgroups | dev.linux.lists.gfs2,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
Reject DLM_OPTS packets whose wrapped inner message length exceeds the
bytes remaining inside the validated outer packet. This keeps malformed
wrapped RCOM replies from reaching downstream length-driven copies.
Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <[email protected]>
---
fs/dlm/midcomms.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c
index 8964164600d2..7953a205244a 100644
--- a/fs/dlm/midcomms.c
+++ b/fs/dlm/midcomms.c
@@ -652,6 +652,14 @@ static int dlm_opts_check_msglen(const union dlm_packet *p, uint16_t msglen,
return -1;
}
+ p = (const union dlm_packet *)((const unsigned char *)p->opts.o_opts +
+ le16_to_cpu(p->opts.o_optlen));
+ if (le16_to_cpu(p->header.h_length) > len) {
+ log_print("inner msg too large: %u > %d, will skip this message from node %d",
+ le16_to_cpu(p->header.h_length), len, nodeid);
+ return -1;
+ }
+
return 0;
}
--
2.47.3