diff options
| author | Ziyi Guo <n7l8m4@u.northwestern.edu> | 2026-04-27 11:59:33 -0400 |
|---|---|---|
| committer | David Teigland <teigland@redhat.com> | 2026-05-08 08:38:03 -0500 |
| commit | b5314f2c6654a3616fd72777deb1ca766cc50618 (patch) | |
| tree | 06cbd6e453e40783b53f82be73e7a59728d27a63 /include/linux/timerqueue_types.h | |
| parent | a1ed04430f805364eeffe9afacf3ec0d152a8e83 (diff) | |
dlm: add usercopy whitelist to dlm_cb cache
The dlm_cb slab cache is created with kmem_cache_create(), which
provides no usercopy whitelist. When a callback carries LVB data,
dlm_user_add_ast() copies the LVB into the inline lvbptr[] array within
the slab-allocated struct dlm_callback and redirects ua->lksb.sb_lvbptr
to point to it. copy_result_to_user() then calls copy_to_user() with
this pointer. With CONFIG_HARDENED_USERCOPY enabled, this triggers
usercopy_abort().
Switch to kmem_cache_create_usercopy() with a whitelist covering the
lvbptr field.
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Acked-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Diffstat (limited to 'include/linux/timerqueue_types.h')
0 files changed, 0 insertions, 0 deletions