From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6547D388860 for ; Fri, 10 Jul 2026 10:34:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783679687; cv=none; b=JTF3WWTlgULKl+z59IWP+wUSjF9oSVlyhXtOtLcU3xk8m1eBjP38fiBdn3GKK1hadqyb0iAOBDT5JyMJLolCZmcI9d8EjqHtGIFglekQlsjqDwD9cFI7EIhXVrtIwUl1JWRXpOPSXo9l0A+z9SLdnhKDRrMT9aATCOv9J26AvPY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783679687; c=relaxed/simple; bh=DVGBVk+mO7WPLb+Zs+aUZlOHthLb5rGfTXLOLzkiN6Q=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=hkbrokLO2HBYOPBzXrOKllO6Rlrs1yhRLfY1lKWapLkGGknaj9VaFUgV51EGoqMbYNWQx8JgFeP/y1ngbd1GRQ1EeHNDM3nQ1Jdx4qP0q1xT2X+wb/JSG39dTF2dFS3y6IevMocr1XuA/qrSynFp4F8rxRpx8/ayrKjGmSj8+o8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linbit.com; spf=pass smtp.mailfrom=linbit.com; dkim=pass (2048-bit key) header.d=linbit-com.20251104.gappssmtp.com header.i=@linbit-com.20251104.gappssmtp.com header.b=Y+ZGEDP2; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linbit.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linbit.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linbit-com.20251104.gappssmtp.com header.i=@linbit-com.20251104.gappssmtp.com header.b="Y+ZGEDP2" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-47122683cf3so466210f8f.0 for ; Fri, 10 Jul 2026 03:34:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linbit-com.20251104.gappssmtp.com; s=20251104; t=1783679684; x=1784284484; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:mail-followup-to:message-id:subject:cc:to:from:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=0hNKws68GKcsqG1qn9goDkKgmOz4q7bVaIJzV/ptteo=; b=Y+ZGEDP2flq2OEPBlctnl7vFP3FsaRl0VVTGAtDMwehbuh/57Vv6uCdmyHQiOP7/rr C6tGsYhqrKwHu2auQDagKPGtTP0jhiYj+ZHUfqcC/BAwyFrtNMo7Qw/zoiOBJbbAFq17 wmfaOkdrgoGoHhVktif7u34+8BoF9fNJCwekqTKh+qfewfh5yFYze4GoSkm5K0Gs86Js StgBbNRlP8JyRwgJnGwOGQXvyMC40dLqfpuWHDr3hcyH13LEuxQwIHTtb3ImR3ox15C4 J3N79yNXCIgqWva1y60OJ5M+sgAOL9UmErBms/GwMTxBgEdV55MYa8NHHDwXwuxUQezy zQPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783679684; x=1784284484; h=in-reply-to:content-disposition:content-type:mime-version :references:mail-followup-to:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=0hNKws68GKcsqG1qn9goDkKgmOz4q7bVaIJzV/ptteo=; b=KY5xrX2qQ7W4H8eYvbdwdJ5Yee2aRAh8aXNz1hZnFTVWbcCUdYKL53jrUTPsc7Hglz hn26RKJCDOpODOhwt1OjaBCZrCHxoHq5rDBSTuv6W9u/A+stjZlwNqCurFf/ENLkJ+mn C51B728mfGbrTGWG2M2VJtdttRFNNGW5oXTG6m/hW8sEp6iM7KbYHvjBcMFLgZ6kHEdu Mixuc5iztU6UvlhDzATcr9PJtUjVGx0aKMqpWDJj717F2i8w28qOardxRnVsjDtGmOZt w68FOEfvOUQaKrDtPlkGbBaobPuNumyUiKgMlDpOtYQzRRSwmgStQx2Kb0auA6YmqgNq taXQ== X-Forwarded-Encrypted: i=1; AHgh+RpdTwTJWqpYxF0sLsAAHfQN9IlsBcARPOzxkkC30nG50GHLeo0YLSBypUJIs+OiMUXAsMYpE5+IXK66jc0=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+4ZRBo9RW0z+XJcnX3+a1rgbtekXA/w4Mu3He1dKwbMxOK+UR SAKynxc3lYAxnPTGn1KqZD2CX3xNgkHwmdl2aGoxSqrYXCUMRyeT+j0pNWfU9cmLfN0= X-Gm-Gg: AfdE7ckUVRAWsWZ3Q+3ajOCTD5nHa5vjqGpB8LLuDSmmmaErgAuCknjUluST/hPBD1R NWjM7o7hBXFTjM3V72lB4e+WHDGrTzg4cmeWLqscnHJC/Y07EESDfjCkdrIpAPA4Ez95N6jnaPK ghuJIVNGc4pyDf/dN6ktLsA10db/63Z0/v6eHYSzTBbY3nNMXvVdLGxifem8wUdambsZpnXWnFA y7mp8i795o6Nh5J5+ihVUStwJm8htBWGMLFmPFB6oPG8C+6jpnPKKLhL4Rr71usvVWU0FcbT93+ SP2T91ImSrPcoHyGtabOdYBc1SaGty957bmLaFCtkWjN2MWyMC87jd3y6h8OgBKwobxQQp3Wlzq J/fBTQJjCf0HDmQm9V1nabD5lAObW/96m82IJE593YFWAtL7WjKnQEgSlTNqhjeSMxCszCZIr8u Tfhlyb5wBl2jbACguwDLMZUWUWz0cgy75RAxmFCJW2yAZ0gGxgphNQrgNo X-Received: by 2002:a05:6000:26c2:b0:47d:f01d:104b with SMTP id ffacd0b85a97d-47df077657cmr11701617f8f.46.1783679683738; Fri, 10 Jul 2026 03:34:43 -0700 (PDT) Received: from localhost (h082218129081.host.wavenet.at. [82.218.129.81]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47aa039bcdasm61474279f8f.21.2026.07.10.03.34.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 03:34:43 -0700 (PDT) Date: Fri, 10 Jul 2026 12:34:42 +0200 From: Christoph =?utf-8?Q?B=C3=B6hmwalder?= To: Tianchu Chen Cc: philipp.reisner@linbit.com, lars.ellenberg@linbit.com, drbd-dev@lists.linbit.com, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, axboe@kernel.dk Subject: Re: [PATCH] drbd: reject oversized DataReply before signed conversion Message-ID: Mail-Followup-To: Tianchu Chen , philipp.reisner@linbit.com, lars.ellenberg@linbit.com, drbd-dev@lists.linbit.com, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, axboe@kernel.dk References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: On Tue, Jun 30, 2026 at 10:59:31AM +0000, Tianchu Chen wrote: >From: Tianchu Chen > >Discovered by Atuin - Automated Vulnerability Discovery Engine. > >Reject DataReply payload lengths that cannot fit in recv_dless_read()'s >signed size argument so a bogus remote peer cannot wrap the length negative >and turn it into a huge heap OOB-write. > >Fixes: b411b3637fa7 ("The DRBD driver") >Cc: stable@vger.kernel.org >Signed-off-by: Tianchu Chen This is similar to [0], but the mentioned patch is a more complete fix. There is also a case in recv_dless_read where data_size can underflow when a data-integrity-alg is configured. The other patch catches this case as well by placing the guard later, so I would prefer to apply that one instead of this. Thanks, Christoph [0] https://lore.kernel.org/all/20260710022837.3738461-1-michael.bommarito@gmail.com/