From: Christian Brauner <brauner@kernel.org>
To: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Arve Hjønnevåg" <arve@android.com>,
"Todd Kjos" <tkjos@android.com>,
"Martijn Coenen" <maco@android.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Hridya Valsaraju" <hridya@google.com>,
"Suren Baghdasaryan" <surenb@google.com>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
"Todd Kjos" <tkjos@google.com>
Subject: Re: [PATCH] binderfs: Fix the maximum minor value in binderfs_binder_device_create() and binderfs_binder_ctl_create()
Date: Tue, 29 Mar 2022 13:20:11 +0200 [thread overview]
Message-ID: <20220329112011.j4xf2qjktfqokkyn@wittgenstein> (raw)
In-Reply-To: <ba880255b91b4682c21c62ae0bc5673e34a119aa.1648379891.git.christophe.jaillet@wanadoo.fr>
On Sun, Mar 27, 2022 at 01:18:17PM +0200, Christophe JAILLET wrote:
> ida_alloc_max(..., max, ...) returns values from 0 to max, inclusive.
>
> So, BINDERFS_MAX_MINOR is a valid value for 'minor'.
>
> BINDERFS_MAX_MINOR is '1U << MINORBITS' and we have:
> #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi))
>
> So, When this value is used in MKDEV() and it will overflow.
>
> Fixes: 3ad20fe393b3 ("binder: implement binderfs")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> This patch is completely speculative.
>
> The 'BINDERFS_MAX_MINOR_CAPPED - 1' is here only for symmetry with the
> BINDERFS_MAX_MINOR case. I'm not sure at all that is is needed and, more
> importantly, that it is correct.
Hm, since we're "removing" one alloctable device for the initial ipc
namespace, I think we need the -1 for the capped value.
Though I wonder if the simpler fix wouldn't just be to:
#define BINDERFS_MAX_MINOR MINORMASK
since include/linux/kdev_t.h has:
#define MINORBITS 20
#define MINORMASK ((1U << MINORBITS) - 1)
next prev parent reply other threads:[~2022-03-29 11:20 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-27 11:18 [PATCH] binderfs: Fix the maximum minor value in binderfs_binder_device_create() and binderfs_binder_ctl_create() Christophe JAILLET
2022-03-29 11:20 ` Christian Brauner [this message]
2022-03-31 20:35 ` Christophe JAILLET
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220329112011.j4xf2qjktfqokkyn@wittgenstein \
--to=brauner@kernel.org \
--cc=arve@android.com \
--cc=christophe.jaillet@wanadoo.fr \
--cc=gregkh@linuxfoundation.org \
--cc=hridya@google.com \
--cc=joel@joelfernandes.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=surenb@google.com \
--cc=tkjos@android.com \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.