Re: [PATCH] drbd: reject out-of-range sizes when draining data

[Christoph Böhmwalder]

On Mon, Jul 13, 2026 at 10:34:34AM +0800, Linmao Li wrote:
> drbd_drain_block() receives the peer-provided payload size through a
> signed int argument. A wire length above INT_MAX therefore becomes
> negative. The receive loop still runs, converts the negative result of
> min_t() to an unsigned length, and may receive more than the single
> allocated page can hold.
>
> Commit bd910a7660d2 ("drbd: reject data replies with an out-of-range
> payload size") addressed the same issue in recv_dless_read(), but the
> error paths which discard payload data still use drbd_drain_block().
>
> Reject negative sizes before allocating and mapping the temporary page.
>
> Fixes: b411b3637fa7 ("The DRBD driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Linmao Li <lilinmao@xxxxxxxxxx>
> ---
> drivers/block/drbd/drbd_receiver.c | 5 +++++
> 1 file changed, 5 insertions(+)

Yep, same thing -- DRBD usually chooses to trust its peers, but the
consequences here are pretty bad and the fix is trivial, so let's do it.

Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@xxxxxxxxxx>

Thanks,
Christoph