From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Aring Date: Mon, 4 Jan 2021 16:00:24 -0500 Subject: [Cluster-devel] [PATCHv3 dlm/next 20/20] fs: dlm: check for invalid namelen In-Reply-To: <20210104210024.233765-1-aahringo@redhat.com> References: <20210104210024.233765-1-aahringo@redhat.com> Message-ID: <20210104210024.233765-21-aahringo@redhat.com> List-Id: To: cluster-devel.redhat.com MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit This patch adds an additional check inside the dlm locking from user space functionality that the namelen isn't above the maximum allowed dlm resource name length. If the namelen is above the maximum allowed we have a invalid state and out of buffer access can occur. Cut off the namelen attribute to maximum size is not an option because we might run into name conflicts and the user should be get aware of that. Signed-off-by: Alexander Aring --- fs/dlm/user.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/dlm/user.c b/fs/dlm/user.c index e5cefa90b1ce..9f2f743eeb31 100644 --- a/fs/dlm/user.c +++ b/fs/dlm/user.c @@ -241,6 +241,9 @@ static int device_user_lock(struct dlm_user_proc *proc, uint32_t lkid; int error = -ENOMEM; + if (params->namelen > DLM_RESNAME_MAXLEN) + return -EINVAL; + ls = dlm_find_lockspace_local(proc->lockspace); if (!ls) return -ENOENT; -- 2.26.2