[PATCH] char:misc minor is overflowing

[PATCH] char:misc minor is overflowing

[Shivnandan Kumar]

 When a driver register as a misc driver and 
 it tries to allocate  minor number dynamically.
 Then there is a chance of minor number overflow.
 The problem is that 64(DYNAMIC_MINORS) is not enough 
 for dynamic minor number and if kernel defines 0-63
 for dynamic minor number, it should be reserved. But,0-10
 was used for other devices,  for example 1 is reserved for 
 PSMOUSE. I got the issue that misc_minors is 0x3FFFFFFFFFFFFFFF 
 and so, value of variable 'i' in function misc_register becomes 
 62 and so misc_minors become 1.(Which was already reserved
 for PSMOUSE). This patch help to avoid the 
 above problem.

Signed-off-by: shivnandan kumar <shivnandan.k@samsung.com>
---
 drivers/char/misc.c        |    5 ++---
 include/linux/miscdevice.h |    1 +
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 8069b36..1a6a640 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -198,7 +198,7 @@ int misc_register(struct miscdevice * misc)
 			err = -EBUSY;
 			goto out;
 		}
-		misc->minor = DYNAMIC_MINORS - i - 1;
+		misc->minor = DYNAMIC_MINORS - i - 1 + DYNAMIC_MINOR_START;
 		set_bit(i, misc_minors);
 	} else {
 		struct miscdevice *c;
@@ -218,8 +218,7 @@ int misc_register(struct miscdevice * misc)
 					  misc, misc->groups, "%s", misc->name);
 	if (IS_ERR(misc->this_device)) {
 		if (is_dynamic) {
-			int i = DYNAMIC_MINORS - misc->minor - 1;
+			int i = DYNAMIC_MINORS - misc->minor - 1 + DYNAMIC_MINOR_START;
 			if (i < DYNAMIC_MINORS && i >= 0)
 				clear_bit(i, misc_minors);
 			misc->minor = MISC_DYNAMIC_MINOR;
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 81f6e42..7aa931e 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -19,6 +19,7 @@
 #define APOLLO_MOUSE_MINOR	7	/* unused */
 #define PC110PAD_MINOR		9	/* unused */
 /*#define ADB_MOUSE_MINOR	10	FIXME OBSOLETE */
+#define DYNAMIC_MINOR_START	11
 #define WATCHDOG_MINOR		130	/* Watchdog timer     */
 #define TEMP_MINOR		131	/* Temperature Sensor */
 #define RTC_MINOR		135
-- 
1.7.9.5

Re: [PATCH] char:misc minor is overflowing

[Greg Kroah-Hartman]

On Fri, Nov 20, 2015 at 03:35:34PM +0530, Shivnandan Kumar wrote:
>  When a driver register as a misc driver and 
>  it tries to allocate  minor number dynamically.
>  Then there is a chance of minor number overflow.
>  The problem is that 64(DYNAMIC_MINORS) is not enough 
>  for dynamic minor number and if kernel defines 0-63
>  for dynamic minor number, it should be reserved.

What system do you have that we have more than 63 dynamic minors being
asked for?  We should turn some of them into "real" minors if you rely
on too many of these.

thanks,

greg k-h

Re: [PATCH] char:misc minor is overflowing

[One Thousand Gnomes]

On Wed, 09 Dec 2015 12:51:33 +0000 (GMT)
Nitin Gupta <nitin.gupta@samsung.com> wrote:

> Hi,
> 
> Is there any modification / improvement needed in this patch ?
> 
> ------- Original Message -------
> Sender : Shivnandan Kumar<shivnandan.k@samsung.com> Engineer/SRI-Noida-Advance Solutions - System 1 R&D Group/Samsung Electronics
> Date : Nov 20, 2015 15:35 (GMT+05:30)
> Title : [PATCH] char:misc minor is overflowing
> 
> When a driver register as a misc driver and 
> it tries to allocate  minor number dynamically.
> Then there is a chance of minor number overflow.
> The problem is that 64(DYNAMIC_MINORS) is not enough 

If you are allocating more than the odd minor number you shouldn't be
using misc devices in the first place but should be using
cdev_init/cdev_add/register_chrdev_region and friends.

So 64 really should never be "not enough". miscdevice is more historical
than useful and really goes back to the days long before all the region
allocators existed.

Alan