Reject DLM_OPTS packets whose wrapped inner message length exceeds the
bytes remaining inside the validated outer packet. This keeps malformed
wrapped RCOM replies from reaching downstream length-driven copies.

Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 fs/dlm/midcomms.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/dlm/midcomms.c b/fs/dlm/midcomms.c
index 8964164600d2..7953a205244a 100644
--- a/fs/dlm/midcomms.c
+++ b/fs/dlm/midcomms.c
@@ -652,6 +652,14 @@ static int dlm_opts_check_msglen(const union dlm_packet *p, uint16_t msglen,
 		return -1;
 	}
 
+	p = (const union dlm_packet *)((const unsigned char *)p->opts.o_opts +
+				       le16_to_cpu(p->opts.o_optlen));
+	if (le16_to_cpu(p->header.h_length) > len) {
+		log_print("inner msg too large: %u > %d, will skip this message from node %d",
+			  le16_to_cpu(p->header.h_length), len, nodeid);
+		return -1;
+	}
+
 	return 0;
 }
 
-- 
2.47.3

Hi,

On Tue, Aug 18, 2026 at 10:28 AM Jérémy Jean
<Jeremy.Jean@oss.cyber.gouv.fr> wrote:
>
> Reject DLM_OPTS packets whose wrapped inner message length exceeds the
> bytes remaining inside the validated outer packet. This keeps malformed
> wrapped RCOM replies from reaching downstream length-driven copies.
>
> Fixes: 489d8e559c65 ("fs: dlm: add reliable connection if reconnect")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Acked-by: Alexander Aring <aahringo@redhat.com>

Thanks!

- Alex