linux-kernel - [PATCH RFC] char: misc: Enforce simple minor space division

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250620-rfc_miscdev-v1-1-fda25d502a37@oss.qualcomm.com>
Date: Fri, 20 Jun 2025 22:53:32 +0800
From: Zijun Hu <zijun_hu@...oud.com>
To: Arnd Bergmann <arnd@...db.de>, 
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Zijun Hu <zijun_hu@...oud.com>, linux-kernel@...r.kernel.org, 
 Zijun Hu <zijun.hu@....qualcomm.com>
Subject: [PATCH RFC] char: misc: Enforce simple minor space division

From: Zijun Hu <zijun.hu@....qualcomm.com>

Enforce simple minor space division related to macro MISC_DYNAMIC_MINOR
defined as 255 currently:

<  255 : Fixed minor codes
== 255 : Indicator to request dynamic minor code
>  255 : Dynamic minor codes requested

This enforcing division also solves misc_register() reentry issue below:

// Suppose both static @dev_A and @dev_B want to request dynamic minors.
@dev_A.minor(255) @dev_B.minor(255)

// Register @dev_A then de-register it.
@dev_A.minor(255) -> registered -> @dev_A.minor(500) -> de-registered
-> @dev_A.minor(500)

// Register @dev_B
@dev_B.minor(255) -> registered -> @dev_B.minor(500)

// Register @dev_A again
@dev_A.minor(500) -> encounter -EBUSY error since @dev_B has got 500.

Side effects:
It will be refused to register device whose fixed minor > 255.

Signed-off-by: Zijun Hu <zijun.hu@....qualcomm.com>
---
 drivers/char/misc.c        | 16 +++++++++++++---
 include/linux/miscdevice.h |  8 ++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index e5ea36bbf6b3d1313eb35d3259617bf90c55727d..e6a5907bbf915b4dd64522ada3024ba163cb7aa3 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -132,7 +132,8 @@ static int misc_open(struct inode *inode, struct file *file)
 		break;
 	}
 
-	if (!new_fops) {
+	/* Only request module for fixed minor code */
+	if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
 		mutex_unlock(&misc_mtx);
 		request_module("char-major-%d-%d", MISC_MAJOR, minor);
 		mutex_lock(&misc_mtx);
@@ -144,10 +145,11 @@ static int misc_open(struct inode *inode, struct file *file)
 			new_fops = fops_get(iter->fops);
 			break;
 		}
-		if (!new_fops)
-			goto fail;
 	}
 
+	if (!new_fops)
+		goto fail;
+
 	/*
 	 * Place the miscdevice in the file's
 	 * private_data so it can be used by the
@@ -210,6 +212,12 @@ int misc_register(struct miscdevice *misc)
 	int err = 0;
 	bool is_dynamic = (misc->minor == MISC_DYNAMIC_MINOR);
 
+	if (misc->minor > MISC_DYNAMIC_MINOR) {
+		pr_err("Invalid fixed minor code %d for misc char device '%s'\n",
+		       misc->minor, misc->name);
+		return -EINVAL;
+	}
+
 	INIT_LIST_HEAD(&misc->list);
 
 	mutex_lock(&misc_mtx);
@@ -282,6 +290,8 @@ void misc_deregister(struct miscdevice *misc)
 	list_del(&misc->list);
 	device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor));
 	misc_minor_free(misc->minor);
+	if (misc->minor > MISC_DYNAMIC_MINOR)
+		misc->minor = MISC_DYNAMIC_MINOR;
 	mutex_unlock(&misc_mtx);
 }
 EXPORT_SYMBOL(misc_deregister);
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index 3e6deb00fc8535a7571f85489c74979e18385bad..9e19bce981f065ea612da0a330c529e9c044c996 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -71,6 +71,14 @@
 #define USERIO_MINOR		240
 #define VHOST_VSOCK_MINOR	241
 #define RFKILL_MINOR		242
+
+/*
+ * Misc char device minor code space division related to below macro:
+ *
+ * <  255  : Fixed minor codes
+ * == 255  : Indicator to request dynamic minor code
+ * >  255  : Dynamic minor codes requested
+ */
 #define MISC_DYNAMIC_MINOR	255
 
 struct miscdevice {

---
base-commit: 19272b37aa4f83ca52bdf9c16d5d81bdd1354494
change-id: 20250620-rfc_miscdev-788bf18bba5d
prerequisite-change-id: 20250620-fix_mischar-794de4259592:v1
prerequisite-patch-id: 775e6edc4107a26a1fa30fd36315e4862dbc0cde
prerequisite-patch-id: e32024c7470a34eb019af4bf18c08f67c3589d7e
prerequisite-patch-id: 70045b4ad94130f051c314339a58217baed9190a

Best regards,
-- 
Zijun Hu <zijun.hu@....qualcomm.com>