[Drbd-dev] integer signedness mixup problem in drbd_main.c

[Marc Schiffbauer <m@sys4.de>]

[-- Attachment #1: Type: text/plain, Size: 993 bytes --]

hi all,

using a kernel hardened with grsecurity/PaX we discovered a problem 
where PaX detects a size overflow after a quite large uptime:

PAX: size overflow detected in function drbd_send_dblock 
drivers/block/drbd/drbd_main.c:1625 cicus.964_133 max, count: 1

this was in kernel 3.14.19, but 4.4.5 still seems to have that problem.  
The line triggering this is:

p->seq_num = cpu_to_be32(atomic_inc_return_unchecked(&mdev->packet_seq));

(line 1625 in linux 3.14.19 and 1637 in linux 4.4.5)

please see [1] for more details.

Please can you tell whether this should be fixed in drbd? Or might this 
be some false positive in PaX?

regards
-Marc

[1] https://forums.grsecurity.net/viewtopic.php?f=3&t=4425

-- 
[*] sys4 AG

http://sys4.de, +49 (89) 30 90 46 64
Franziskanerstraße 15, 81669 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]