drbd_drain_block() receives the peer-provided payload size through a
signed int argument. A wire length above INT_MAX therefore becomes
negative. The receive loop still runs, converts the negative result of
min_t() to an unsigned length, and may receive more than the single
allocated page can hold.

Commit bd910a7660d2 ("drbd: reject data replies with an out-of-range
payload size") addressed the same issue in recv_dless_read(), but the
error paths which discard payload data still use drbd_drain_block().

Reject negative sizes before allocating and mapping the temporary page.

Fixes: b411b3637fa7 ("The DRBD driver")
Cc: stable@vger.kernel.org
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
---
 drivers/block/drbd/drbd_receiver.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 2135c14354a8..38721afa0006 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1772,6 +1772,11 @@ static int drbd_drain_block(struct drbd_peer_device *peer_device, int data_size)
 	int err = 0;
 	void *data;
 
+	if (data_size < 0) {
+		drbd_err(peer_device, "Invalid data block size\n");
+		return -EIO;
+	}
+
 	if (!data_size)
 		return 0;
 
-- 
2.25.1

On Mon, Jul 13, 2026 at 10:34:34AM +0800, Linmao Li wrote:
>drbd_drain_block() receives the peer-provided payload size through a
>signed int argument. A wire length above INT_MAX therefore becomes
>negative. The receive loop still runs, converts the negative result of
>min_t() to an unsigned length, and may receive more than the single
>allocated page can hold.
>
>Commit bd910a7660d2 ("drbd: reject data replies with an out-of-range
>payload size") addressed the same issue in recv_dless_read(), but the
>error paths which discard payload data still use drbd_drain_block().
>
>Reject negative sizes before allocating and mapping the temporary page.
>
>Fixes: b411b3637fa7 ("The DRBD driver")
>Cc: stable@vger.kernel.org
>Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
>---
> drivers/block/drbd/drbd_receiver.c | 5 +++++
> 1 file changed, 5 insertions(+)

Yep, same thing -- DRBD usually chooses to trust its peers, but the
consequences here are pretty bad and the fix is trivial, so let's do it.

Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>

Thanks,
Christoph