[PATCH] drbd: reject out-of-range sizes when draining data

[Linmao Li]

drbd_drain_block() receives the peer-provided payload size through a
signed int argument. A wire length above INT_MAX therefore becomes
negative. The receive loop still runs, converts the negative result of
min_t() to an unsigned length, and may receive more than the single
allocated page can hold.

Commit bd910a7660d2 ("drbd: reject data replies with an out-of-range
payload size") addressed the same issue in recv_dless_read(), but the
error paths which discard payload data still use drbd_drain_block().

Reject negative sizes before allocating and mapping the temporary page.

Fixes: b411b3637fa7 ("The DRBD driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
---
 drivers/block/drbd/drbd_receiver.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 2135c14354a8..38721afa0006 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1772,6 +1772,11 @@ static int drbd_drain_block(struct drbd_peer_device *peer_device, int data_size)
 	int err = 0;
 	void *data;
 
+	if (data_size < 0) {
+		drbd_err(peer_device, "Invalid data block size\n");
+		return -EIO;
+	}
+
 	if (!data_size)
 		return 0;
 
-- 
2.25.1