drbd: check for corrupt or malicous sector addresses when receiving data

Even if it should never happen if the peer does behave, we need to
double check, and not even attempt access beyond end of device.
It usually would be caught by lower layers, resulting in "IO error",
but may also end up in the internal meta data area.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index c3504ddd59c1..3a36bc814e77 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1262,6 +1262,7 @@ static int receive_Barrier(struct drbd_conf *mdev, struct p_header *h)
 static struct drbd_epoch_entry *
 read_in_block(struct drbd_conf *mdev, u64 id, sector_t sector, int data_size) __must_hold(local)
 {
+        const sector_t capacity = drbd_get_capacity(mdev->this_bdev);
         struct drbd_epoch_entry *e;
         struct bio_vec *bvec;
         struct page *page;
@@ -1287,6 +1288,15 @@ read_in_block(struct drbd_conf *mdev, u64 id, sector_t sector, int data_size) __
         ERR_IF(data_size &  0x1ff) return NULL;
         ERR_IF(data_size >  DRBD_MAX_SEGMENT_SIZE) return NULL;
 
+        /* even though we trust out peer,
+         * we sometimes have to double check. */
+        if (sector + (data_size>>9) > capacity) {
+                dev_err(DEV, "capacity: %llus < sector: %llus + size: %u\n",
+                        (unsigned long long)capacity,
+                        (unsigned long long)sector, data_size);
+                return NULL;
+        }
+
         /* GFP_NOIO, because we must not cause arbitrary write-out: in a DRBD
          * "criss-cross" setup, that might cause write-out on some other DRBD,
          * which in turn might block on the other node at this very place.  */