[PATCH] drbd: keep discarded packet size unsigned

[PATCH] drbd: keep discarded packet size unsigned

[Weiming Shi]

Packet lengths are decoded into an unsigned int, but
ignore_remaining_packet() stores pi->size in an int.  Values above
INT_MAX therefore become negative; min_t(int, ...) preserves the negative
value and drbd_recv() converts it to size_t, allowing the receive to
overrun the 4 KiB rbuf.

Keep the remaining size unsigned and clamp it as an unsigned value so that
each receive is bounded by DRBD_SOCKET_BUFFER_SIZE.

A KASAN reproducer reported:

  BUG: KASAN: slab-out-of-bounds in _copy_to_iter
  Write of size 32672 at addr ffff888027129000 by task drbd_r_r0/5002
  Call Trace:
   _copy_to_iter lib/iov_iter.c:197
   simple_copy_to_iter net/core/datagram.c:521
   __skb_datagram_iter net/core/datagram.c:435
   skb_copy_datagram_iter net/core/datagram.c:537
   tcp_recvmsg_locked net/ipv4/tcp.c:2846
   tcp_recvmsg net/ipv4/tcp.c:2949
   inet_recvmsg net/ipv4/af_inet.c:896
   sock_recvmsg net/socket.c:1159
   drbd_recv_short drivers/block/drbd/drbd_receiver.c:322
   drbd_recv drivers/block/drbd/drbd_receiver.c:331
   config_unknown_volume drivers/block/drbd/drbd_receiver.c:3624
   receive_SyncParam drivers/block/drbd/drbd_receiver.c:3671
   drbd_receiver drivers/block/drbd/drbd_receiver.c:5366

Fixes: 4a76b1612f35 ("drbd: Map from (connection, volume number) to device in the receive handlers")
Cc: stable@vger.kernel.org
Reported-by: <co+4618907cccdeffa@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 drivers/block/drbd/drbd_receiver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index 58b95bf4bdca6..3fb73fbfd5f27 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -3616,10 +3616,10 @@ static struct crypto_shash *drbd_crypto_alloc_digest_safe(
 static int ignore_remaining_packet(struct drbd_connection *connection, struct packet_info *pi)
 {
 	void *buffer = connection->data.rbuf;
-	int size = pi->size;
+	unsigned int size = pi->size;
 
 	while (size) {
-		int s = min_t(int, size, DRBD_SOCKET_BUFFER_SIZE);
+		int s = min_t(unsigned int, size, DRBD_SOCKET_BUFFER_SIZE);
 		s = drbd_recv(connection, buffer, s);
 		if (s <= 0) {
 			if (s < 0)
-- 
2.55.0