Re: [PATCH] dlm: The core of the DLM for GFS2/CLVM

[Alexander Aring]

Hi,

On Sat, Jun 27, 2026 at 12:18 PM Danila Chernetsov <listdansp@xxxxxxx> wrote:
>
> The DLM recovery path restores lock state from rcom_lock messages
> received from remote nodes. The lock modes in these messages are
> copied directly into the local lkb state without validating that they
> are within the valid DLM lock mode range.
>
> The rest of the DLM code assumes that lkb_rqmode and lkb_grmode
> contain valid lock modes. In particular, LVB callback handling in
> dlm_may_skip_callback() uses lock modes as indexes into the
> dlm_lvb_operations array:
>
>     dlm_lvb_operations[prev_mode + 1][mode + 1]
>
> An invalid lock mode received during recovery could therefore result in
> an out-of-bounds read during subsequent LVB callback processing.
>
> Validate rl_rqmode and rl_grmode before storing them into the local LKB
> state. This preserves the lock mode invariant required by the rest of
> the DLM code.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: e7fd41792fc0 ("[DLM] The core of the DLM for GFS2/CLVM")
> Signed-off-by: Danila Chernetsov <listdansp@xxxxxxx>

Acked-by: Alexander Aring <aahringo@xxxxxxxxxx>

This issue dates back to the initial DLM commit, and we've never
implemented validation for many DLM message fields.

I am sure there are more issues like that; a follow-up patch should
clean up or revisit this whole part of DLM and validate messages at
the lower message parsing level...
I will add this to my list for follow-up patches to improve this
situation in DLM.

- Alex