6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ezrak1e [ Upstream commit 080e5563f878c64e697b89e7439d730d0daad882 ] The len parameter in dlm_dump_rsb_name() is not validated and comes from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can cause out-of-bounds write in dlm_search_rsb_tree(). Add length validation to prevent potential buffer overflow. Signed-off-by: Ezrak1e Signed-off-by: Alexander Aring Signed-off-by: David Teigland [ Contextual conflict due to dlm_search_rsb_tree() using the RB-tree implementation instead of rhashtable.] Signed-off-by: Srikanth C S Signed-off-by: Harshit Mogalapalli Signed-off-by: Sasha Levin --- fs/dlm/lock.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 6712d733fc90b..dd2fa54f2b7dd 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -444,6 +444,8 @@ int dlm_search_rsb_tree(struct rb_root *tree, const void *name, int len, struct dlm_rsb *r; int rc; + if (len > DLM_RESNAME_MAXLEN) + return -EINVAL; while (node) { r = rb_entry(node, struct dlm_rsb, res_hashnode); rc = rsb_cmp(r, name, len); -- 2.53.0