From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
To: Christian Brauner <brauner@kernel.org>
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Arve Hjønnevåg" <arve@android.com>,
"Todd Kjos" <tkjos@android.com>,
"Martijn Coenen" <maco@android.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Hridya Valsaraju" <hridya@google.com>,
"Suren Baghdasaryan" <surenb@google.com>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
"Todd Kjos" <tkjos@google.com>
Subject: Re: [PATCH] binderfs: Fix the maximum minor value in binderfs_binder_device_create() and binderfs_binder_ctl_create()
Date: Thu, 31 Mar 2022 22:35:37 +0200 [thread overview]
Message-ID: <5a5fec66-f8af-7e6e-5afe-97e4eb21c51a@wanadoo.fr> (raw)
In-Reply-To: <20220329112011.j4xf2qjktfqokkyn@wittgenstein>
Le 29/03/2022 à 13:20, Christian Brauner a écrit :
> On Sun, Mar 27, 2022 at 01:18:17PM +0200, Christophe JAILLET wrote:
>> ida_alloc_max(..., max, ...) returns values from 0 to max, inclusive.
>>
>> So, BINDERFS_MAX_MINOR is a valid value for 'minor'.
>>
>> BINDERFS_MAX_MINOR is '1U << MINORBITS' and we have:
>> #define MKDEV(ma,mi) (((ma) << MINORBITS) | (mi))
>>
>> So, When this value is used in MKDEV() and it will overflow.
>>
>> Fixes: 3ad20fe393b3 ("binder: implement binderfs")
>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>> ---
>> This patch is completely speculative.
>>
>> The 'BINDERFS_MAX_MINOR_CAPPED - 1' is here only for symmetry with the
>> BINDERFS_MAX_MINOR case. I'm not sure at all that is is needed and, more
>> importantly, that it is correct.
>
> Hm, since we're "removing" one alloctable device for the initial ipc
> namespace, I think we need the -1 for the capped value.
>
> Though I wonder if the simpler fix wouldn't just be to:
>
> #define BINDERFS_MAX_MINOR MINORMASK
>
> since include/linux/kdev_t.h has:
>
> #define MINORBITS 20
> #define MINORMASK ((1U << MINORBITS) - 1)
>
Hi,
I mostly agree with you, but I don't have a strong opinion on the other
uses of BINDERFS_MAX_MINOR.
The ones related to 'max' values looks good to me, but I don't know the
implication for the one used in binderfs_make_inode() and in
init_binderfs().
I won't be able to help further here.
CJ
prev parent reply other threads:[~2022-03-31 20:35 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-27 11:18 [PATCH] binderfs: Fix the maximum minor value in binderfs_binder_device_create() and binderfs_binder_ctl_create() Christophe JAILLET
2022-03-29 11:20 ` Christian Brauner
2022-03-31 20:35 ` Christophe JAILLET [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5a5fec66-f8af-7e6e-5afe-97e4eb21c51a@wanadoo.fr \
--to=christophe.jaillet@wanadoo.fr \
--cc=arve@android.com \
--cc=brauner@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=hridya@google.com \
--cc=joel@joelfernandes.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=surenb@google.com \
--cc=tkjos@android.com \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.