Commit bd910a7660d2 for kernel

commit bd910a7660d280595ef94cb6d193951d855d330f
Author: Michael Bommarito <michael.bommarito@gmail.com>
Date:   Thu Jul 9 22:28:37 2026 -0400

    drbd: reject data replies with an out-of-range payload size

    recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
    outstanding read request. The peer-supplied payload length reaches it as
    the signed int data_size, and two peer-controlled inputs can make it
    negative. With a negotiated data-integrity-alg the digest length is
    subtracted first, so a reply whose payload is smaller than the digest
    underflows data_size. With no integrity algorithm (the default) data_size
    is assigned from the unsigned h95/h100 wire length and drbdd() never
    bounds it for a payload-carrying command, so a length above INT_MAX casts
    it negative; this path needs no non-default feature. The bio receive loop
    then computes expect = min_t(int, data_size, bv_len), which is negative,
    and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
    into the first mapped page.

    The sibling receive path read_in_block() is not affected: it uses an
    unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
    Reject a data reply whose size is negative after the optional digest
    subtraction, covering both triggers.

    Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
    bytes past a bio page in the receiver, corrupting kernel memory. A node
    that reads from its peer (a diskless node, or read-balancing to the peer)
    is exposed in the default configuration; data-integrity-alg is not
    required.

    Fixes: b411b3637fa7 ("The DRBD driver")
    Cc: stable@vger.kernel.org
    Assisted-by: Codex:gpt-5-5-xhigh
    Assisted-by: Claude:claude-opus-4-8
    Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
    Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
    Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 58b95bf4bdca..2135c14354a8 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1810,6 +1810,11 @@ static int recv_dless_read(struct drbd_peer_device *peer_device, struct drbd_req
 		data_size -= digest_size;
 	}

+	if (data_size < 0) {
+		drbd_err(peer_device, "Invalid data reply size\n");
+		return -EIO;
+	}
+
 	/* optimistically update recv_cnt.  if receiving fails below,
 	 * we disconnect anyways, and counters will be reset. */
 	peer_device->device->recv_cnt += data_size>>9;