From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out30-124.freemail.mail.aliyun.com (out30-124.freemail.mail.aliyun.com [115.124.30.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C21C4243964 for ; Wed, 18 Mar 2026 05:54:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.30.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773813296; cv=none; b=I3eOGicaylZ27a7MVavmHQws2x38LBnhzEV06BMi1qdfe0IDS0l3TucAhtT06xZZOvmMe9wxhEl5iNa9bxf8zLXhYf1DA/O5xtsclzVgPb52Bpw1nm8cUrcIjWkcJpIJC+Uw4VNYGHxonlLn3lEpuzGAkasL3jhXG/5etmeNiNY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773813296; c=relaxed/simple; bh=q06Hd9cGal0E1dj5Yz+aULbt/2NUG/SPjqsy0BTLhXY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=NtHJSPtki30L/bFFXy84esNfoymGBfDBUPpEfVQh+WzcDS+ClWFXb1RwItNcSjZsSKZa9li9rz/IRUYoMb1zWIzYGIuI4m7I8hAClFaN5Z6KFtD4b1oUXgrLsyvIL3t5L6aOcpS5DEmaagg5PToGdDp6uv6N8Ztw3JhRlfn44ZI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com; spf=pass smtp.mailfrom=linux.alibaba.com; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b=x07Me1i2; arc=none smtp.client-ip=115.124.30.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.alibaba.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.alibaba.com header.i=@linux.alibaba.com header.b="x07Me1i2" DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.alibaba.com; s=default; t=1773813285; h=Message-ID:Date:MIME-Version:Subject:To:From:Content-Type; bh=rGU94KYt9vOMPtVgMLIhjhXuK6/VSHtJuAV8m3Fz5Og=; b=x07Me1i2XzNTQtlg7on0Ena2SlnlbDW7+U1jI9O4IXXh+E6S3bCgsDsME3yvfKiLXXPcXRTe0feI/hG6Z/mzGjaOcUI8+bpyi2IO3kdKL5VFkZb5IMePzjyeWL0I71sIbjmdSI83MZmYoKJsHI5B0Bl1Okr5XCCXmKaqE6fFq6w= X-Alimail-AntiSpam:AC=PASS;BC=-1|-1;BR=01201311R891e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=maildocker-contentspam033037009110;MF=joseph.qi@linux.alibaba.com;NM=1;PH=DS;RN=8;SR=0;TI=SMTPD_---0X.DLWSg_1773813284; Received: from 30.221.129.103(mailfrom:joseph.qi@linux.alibaba.com fp:SMTPD_---0X.DLWSg_1773813284 cluster:ay36) by smtp.aliyun-inc.com; Wed, 18 Mar 2026 13:54:44 +0800 Message-ID: <2030e53f-8826-4476-a3dc-5bf2c24e1e4d@linux.alibaba.com> Date: Wed, 18 Mar 2026 13:54:43 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/2] ocfs2/dlm: validate qr_numregions in dlm_match_regions() To: Junrui Luo , akpm Cc: ocfs2-devel@lists.linux.dev, linux-kernel@vger.kernel.org, Yuhao Jiang , Mark Fasheh , Joel Becker , Sunil Mushran References: From: Joseph Qi In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 3/7/26 3:21 PM, Junrui Luo wrote: > The qr_numregions field from a DLM_QUERY_REGION network message is used > directly as loop bounds in dlm_match_regions() without checking against > O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS > (32) entries, a crafted message with qr_numregions > 32 causes > out-of-bounds reads past the qr_regions buffer. > > Add a bounds check for qr_numregions before entering the loops. > > Fixes: ea2034416b54 ("ocfs2/dlm: Add message DLM_QUERY_REGION") > Reported-by: Yuhao Jiang > Signed-off-by: Junrui Luo Reviewed-by: Joseph Qi > --- > fs/ocfs2/dlm/dlmdomain.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c > index 70ca79e4bdc3..0a28cb5ded2a 100644 > --- a/fs/ocfs2/dlm/dlmdomain.c > +++ b/fs/ocfs2/dlm/dlmdomain.c > @@ -980,6 +980,14 @@ static int dlm_match_regions(struct dlm_ctxt *dlm, > goto bail; > } > > + if (qr->qr_numregions > O2NM_MAX_REGIONS) { > + mlog(ML_ERROR, "Domain %s: Joining node %d has invalid " > + "number of heartbeat regions %u\n", > + qr->qr_domain, qr->qr_node, qr->qr_numregions); > + status = -EINVAL; > + goto bail; > + } > + > r = remote; > for (i = 0; i < qr->qr_numregions; ++i) { > mlog(0, "Region %.*s\n", O2HB_MAX_REGION_NAME_LEN, r); >