Re: [PATCH] drbd: reject out-of-range sizes when draining data

On Mon, Jul 13, 2026 at 10:34:34AM +0800, Linmao Li wrote:
>drbd_drain_block() receives the peer-provided payload size through a
>signed int argument. A wire length above INT_MAX therefore becomes
>negative. The receive loop still runs, converts the negative result of
>min_t() to an unsigned length, and may receive more than the single
>allocated page can hold.
>
>Commit bd910a7660d2 ("drbd: reject data replies with an out-of-range
>payload size") addressed the same issue in recv_dless_read(), but the
>error paths which discard payload data still use drbd_drain_block().
>
>Reject negative sizes before allocating and mapping the temporary page.
>
>Fixes: b411b3637fa7 ("The DRBD driver")
>Cc: [email protected]
>Signed-off-by: Linmao Li <[email protected]>
>---
> drivers/block/drbd/drbd_receiver.c | 5 +++++
> 1 file changed, 5 insertions(+)

Yep, same thing -- DRBD usually chooses to trust its peers, but the
consequences here are pretty bad and the fix is trivial, so let's do it.

Reviewed-by: Christoph Böhmwalder <[email protected]>

Thanks,
Christoph