All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ye Bin <yebin10@huawei.com>
To: <josef@toxicpanda.com>, <axboe@kernel.dk>,
	<linux-block@vger.kernel.org>, <nbd@other.debian.org>
Cc: <linux-kernel@vger.kernel.org>, Yu Kuai <yukuai3@huawei.com>
Subject: [PATCH -next v4 1/4] nbd: fix max value for 'first_minor'
Date: Tue, 2 Nov 2021 09:52:34 +0800	[thread overview]
Message-ID: <20211102015237.2309763-2-yebin10@huawei.com> (raw)
In-Reply-To: <20211102015237.2309763-1-yebin10@huawei.com>

From: Yu Kuai <yukuai3@huawei.com>

commit b1a811633f73 ("block: nbd: add sanity check for first_minor")
checks that 'first_minor' should not be greater than 0xff, which is
wrong. Whitout the commit, the details that when user pass 0x100000,
it ends up create sysfs dir "/sys/block/43:0" are as follows:

nbd_dev_add
 disk->first_minor = index << part_shift
  -> default part_shift is 5, first_minor is 0x2000000
  device_add_disk
   ddev->devt = MKDEV(disk->major, disk->first_minor)
    -> (0x2b << 20) | (0x2000000) = 0x2b00000
   device_add
    device_create_sys_dev_entry
	 format_dev_t
	  sprintf(buffer, "%u:%u", MAJOR(dev), MINOR(dev));
	   -> got 43:0
	  sysfs_create_link -> /sys/block/43:0

By the way, with the wrong fix, when part_shift is the default value,
only 8 ndb devices can be created since 8 << 5 is greater than 0xff.

Since the max bits for 'first_minor' should be the same as what
MKDEV() does, which is 20. Change the upper bound of 'first_minor'
from 0xff to 0xfffff.

Fixes: b1a811633f73 ("block: nbd: add sanity check for first_minor")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
---
 drivers/block/nbd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index b47b2a87ae8f..678ee2688f63 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1803,11 +1803,11 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)
 	disk->major = NBD_MAJOR;
 
 	/* Too big first_minor can cause duplicate creation of
-	 * sysfs files/links, since first_minor will be truncated to
-	 * byte in __device_add_disk().
+	 * sysfs files/links, since MKDEV() expect that the max bits of
+	 * first_minor is 20.
 	 */
 	disk->first_minor = index << part_shift;
-	if (disk->first_minor > 0xff) {
+	if (disk->first_minor > MINORMASK) {
 		err = -EINVAL;
 		goto out_free_idr;
 	}
-- 
2.31.1


  reply	other threads:[~2021-11-02  1:40 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-02  1:52 [PATCH -next v4 0/4] Fix hungtask when nbd_config_put and sanity check for first_minor Ye Bin
2021-11-02  1:52 ` Ye Bin [this message]
2021-11-02  1:52 ` [PATCH -next v4 2/4] nbd: fix possible overflow for 'first_minor' in nbd_dev_add() Ye Bin
2021-11-02  1:52 ` [PATCH -next v4 3/4] nbd: Fix incorrect error handle when first_minor is illegal in nbd_dev_add Ye Bin
2021-11-02  1:52 ` [PATCH -next v4 4/4] nbd: Fix hungtask when nbd_config_put Ye Bin
2021-11-02 13:04 ` [PATCH -next v4 0/4] Fix hungtask when nbd_config_put and sanity check for first_minor Josef Bacik
2021-11-02 16:50 ` Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211102015237.2309763-2-yebin10@huawei.com \
    --to=yebin10@huawei.com \
    --cc=axboe@kernel.dk \
    --cc=josef@toxicpanda.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nbd@other.debian.org \
    --cc=yukuai3@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.