mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 01:32:21 +02:00
bd910a7660
recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
outstanding read request. The peer-supplied payload length reaches it as
the signed int data_size, and two peer-controlled inputs can make it
negative. With a negotiated data-integrity-alg the digest length is
subtracted first, so a reply whose payload is smaller than the digest
underflows data_size. With no integrity algorithm (the default) data_size
is assigned from the unsigned h95/h100 wire length and drbdd() never
bounds it for a payload-carrying command, so a length above INT_MAX casts
it negative; this path needs no non-default feature. The bio receive loop
then computes expect = min_t(int, data_size, bv_len), which is negative,
and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
into the first mapped page.
The sibling receive path read_in_block() is not affected: it uses an
unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
Reject a data reply whose size is negative after the optional digest
subtraction, covering both triggers.
Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
bytes past a bio page in the receiver, corrupting kernel memory. A node
that reads from its peer (a diskless node, or read-balancing to the peer)
is exposed in the default configuration; data-integrity-alg is not
required.
Fixes:
|
||
|---|---|---|
| .. | ||
| drbd_actlog.c | ||
| drbd_bitmap.c | ||
| drbd_buildtag.c | ||
| drbd_config.h | ||
| drbd_debugfs.c | ||
| drbd_debugfs.h | ||
| drbd_int.h | ||
| drbd_interval.c | ||
| drbd_interval.h | ||
| drbd_main.c | ||
| drbd_nl_gen.c | ||
| drbd_nl_gen.h | ||
| drbd_nl.c | ||
| drbd_polymorph_printk.h | ||
| drbd_proc.c | ||
| drbd_protocol.h | ||
| drbd_receiver.c | ||
| drbd_req.c | ||
| drbd_req.h | ||
| drbd_state_change.h | ||
| drbd_state.c | ||
| drbd_state.h | ||
| drbd_strings.c | ||
| drbd_strings.h | ||
| drbd_vli.h | ||
| drbd_worker.c | ||
| Kconfig | ||
| Makefile | ||