linux-kernel - [PATCH] char:misc minor is overflowing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 20 Nov 2015 15:35:34 +0530
From:	Shivnandan Kumar <shivnandan.k@...sung.com>
To:	Arnd Bergmann <arnd@...db.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	vidushi.koul@...sung.com, gaurav.k6@...sung.com,
	nitin.gupta@...sung.com, rajat.suri@...sung.com,
	p.shailesh@...sung.com, shiv.jnumca08@...il.com,
	linux-kernel@...r.kernel.org
Subject: [PATCH] char:misc minor is overflowing

 When a driver register as a misc driver and 
 it tries to allocate  minor number dynamically.
 Then there is a chance of minor number overflow.
 The problem is that 64(DYNAMIC_MINORS) is not enough 
 for dynamic minor number and if kernel defines 0-63
 for dynamic minor number, it should be reserved. But,0-10
 was used for other devices,  for example 1 is reserved for 
 PSMOUSE. I got the issue that misc_minors is 0x3FFFFFFFFFFFFFFF 
 and so, value of variable 'i' in function misc_register becomes 
 62 and so misc_minors become 1.(Which was already reserved
 for PSMOUSE). This patch help to avoid the 
 above problem.

Signed-off-by: shivnandan kumar <shivnandan.k@...sung.com>
---
 drivers/char/misc.c        |    5 ++---
 include/linux/miscdevice.h |    1 +
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 8069b36..1a6a640 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -198,7 +198,7 @@ int misc_register(struct miscdevice * misc)
 			err = -EBUSY;
 			goto out;
 		}
-		misc->minor = DYNAMIC_MINORS - i - 1;
+		misc->minor = DYNAMIC_MINORS - i - 1 + DYNAMIC_MINOR_START;
 		set_bit(i, misc_minors);
 	} else {
 		struct miscdevice *c;
@@ -218,8 +218,7 @@ int misc_register(struct miscdevice * misc)
 					  misc, misc->groups, "%s", misc->name);
 	if (IS_ERR(misc->this_device)) {
 		if (is_dynamic) {
-			int i = DYNAMIC_MINORS - misc->minor - 1;
+			int i = DYNAMIC_MINORS - misc->minor - 1 + DYNAMIC_MINOR_START;
 			if (i < DYNAMIC_MINORS && i >= 0)
 				clear_bit(i, misc_minors);
 			misc->minor = MISC_DYNAMIC_MINOR;
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 81f6e42..7aa931e 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -19,6 +19,7 @@
 #define APOLLO_MOUSE_MINOR	7	/* unused */
 #define PC110PAD_MINOR		9	/* unused */
 /*#define ADB_MOUSE_MINOR	10	FIXME OBSOLETE */
+#define DYNAMIC_MINOR_START	11
 #define WATCHDOG_MINOR		130	/* Watchdog timer     */
 #define TEMP_MINOR		131	/* Temperature Sensor */
 #define RTC_MINOR		135
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/