linux-kernel - [PATCH 3/4] char: misc: restrict the dynamic range to exclude reserved minors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250123123249.4081674-4-cascardo@igalia.com>
Date: Thu, 23 Jan 2025 09:32:48 -0300
From: Thadeu Lima de Souza Cascardo <cascardo@...lia.com>
To: linux-kernel@...r.kernel.org
Cc: Arnd Bergmann <arnd@...db.de>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Dirk VanDerMerwe <dirk.vandermerwe@...hos.com>,
	Vimal Agrawal <vimal.agrawal@...hos.com>,
	kernel-dev@...lia.com,
	Thadeu Lima de Souza Cascardo <cascardo@...lia.com>
Subject: [PATCH 3/4] char: misc: restrict the dynamic range to exclude reserved minors

When this was first reported [1], the possibility of having sufficient
number of dynamic misc devices was theoretical.

What we know from commit ab760791c0cf ("char: misc: Increase the maximum
number of dynamic misc devices to 1048448"), is that the miscdevice
interface has been used for allocating more than the single-shot devices it
was designed for.

On such systems, it is certain that the dynamic allocation will allocate
certain reserved minor numbers, leading to failures when a later driver
tries to claim its reserved number.

Fixing this is a simple matter of defining the IDA range to allocate from
to exclude minors up to and including 15.

[1] https://lore.kernel.org/all/1257813017-28598-3-git-send-email-cascardo@holoscopio.com/

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@...lia.com>
---
 drivers/char/misc.c        | 4 +++-
 include/linux/miscdevice.h | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index 2cf595d2e10b..7a768775e558 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -68,8 +68,10 @@ static int misc_minor_alloc(int minor)
 	int ret = 0;
 
 	if (minor == MISC_DYNAMIC_MINOR) {
+		int max = DYNAMIC_MINORS - 1 - MISC_STATIC_MAX_MINOR - 1;
 		/* allocate free id */
-		ret = ida_alloc_max(&misc_minors_ida, DYNAMIC_MINORS - 1, GFP_KERNEL);
+		/* Minors from 0 to 15 are reserved. */
+		ret = ida_alloc_max(&misc_minors_ida, max, GFP_KERNEL);
 		if (ret >= 0) {
 			ret = DYNAMIC_MINORS - ret - 1;
 		} else {
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 69e110c2b86a..911a294d17b5 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -21,6 +21,7 @@
 #define APOLLO_MOUSE_MINOR	7	/* unused */
 #define PC110PAD_MINOR		9	/* unused */
 /*#define ADB_MOUSE_MINOR	10	FIXME OBSOLETE */
+#define MISC_STATIC_MAX_MINOR	15	/* Top of first reserved range */
 #define WATCHDOG_MINOR		130	/* Watchdog timer     */
 #define TEMP_MINOR		131	/* Temperature Sensor */
 #define APM_MINOR_DEV		134
-- 
2.34.1