Skip to contentSkip to conversation

rust_binderfs: fix ida_alloc_max() upper bound

PATCH In review Carlos Llamas 2 participants 3 messages Jan 27 – Jan 28

Subsystems (2)
Stable branch Android drivers
lore
Share & tools
lore

Carlos Llamas

author maintainer
#0 lore raw

PATCH 1/2 rust_binderfs: fix ida_alloc_max() upper bound

The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'.

Cc [email protected]
Fixes eafedbc7c050 ("rust_binder: add Rust Binder driver")
Reported-by kernel test robot <[email protected]>
Closes https://lore.kernel.org/r/[email protected]/ open here
Signed-off-by Carlos Llamas <[email protected]>
---
 drivers/android/binder/rust_binderfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/android/binder/rust_binderfs.c +4 -4
index c69026df775c..88374b31ab7c 100644
@@ -132,8 +132,8 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
 	mutex_lock(&binderfs_minors_mutex);
 	if (++info->device_count <= info->mount_opts.max)
 		minor = ida_alloc_max(&binderfs_minors,
-				      use_reserve ? BINDERFS_MAX_MINOR :
-						    BINDERFS_MAX_MINOR_CAPPED,
+				      use_reserve ? BINDERFS_MAX_MINOR - 1 :
+						    BINDERFS_MAX_MINOR_CAPPED - 1,
 				      GFP_KERNEL);
 	else
 		minor = -ENOSPC;

@@ -405,8 +405,8 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 	/* Reserve a new minor number for the new device. */
 	mutex_lock(&binderfs_minors_mutex);
 	minor = ida_alloc_max(&binderfs_minors,
-			      use_reserve ? BINDERFS_MAX_MINOR :
-					    BINDERFS_MAX_MINOR_CAPPED,
+			      use_reserve ? BINDERFS_MAX_MINOR - 1 :
+					    BINDERFS_MAX_MINOR_CAPPED - 1,
 			      GFP_KERNEL);
 	mutex_unlock(&binderfs_minors_mutex);
 	if (minor < 0) {
Signature · 1 line
2.52.0.457.g6b5491de43-goog
author maintainer
#1 lore raw

PATCH 2/2 binderfs: fix ida_alloc_max() upper bound

The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'.

Cc [email protected]
Fixes 3ad20fe393b3 ("binder: implement binderfs")
Signed-off-by Carlos Llamas <[email protected]>
---
 drivers/android/binderfs.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/android/binderfs.c +4 -4
index b46bcb91072d..9f8a18c88d66 100644
@@ -132,8 +132,8 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
 	mutex_lock(&binderfs_minors_mutex);
 	if (++info->device_count <= info->mount_opts.max)
 		minor = ida_alloc_max(&binderfs_minors,
-				      use_reserve ? BINDERFS_MAX_MINOR :
-						    BINDERFS_MAX_MINOR_CAPPED,
+				      use_reserve ? BINDERFS_MAX_MINOR - 1 :
+						    BINDERFS_MAX_MINOR_CAPPED - 1,
 				      GFP_KERNEL);
 	else
 		minor = -ENOSPC;

@@ -408,8 +408,8 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 	/* Reserve a new minor number for the new device. */
 	mutex_lock(&binderfs_minors_mutex);
 	minor = ida_alloc_max(&binderfs_minors,
-			      use_reserve ? BINDERFS_MAX_MINOR :
-					    BINDERFS_MAX_MINOR_CAPPED,
+			      use_reserve ? BINDERFS_MAX_MINOR - 1 :
+					    BINDERFS_MAX_MINOR_CAPPED - 1,
 			      GFP_KERNEL);
 	mutex_unlock(&binderfs_minors_mutex);
 	if (minor < 0) {
Signature · 1 line
2.52.0.457.g6b5491de43-goog
maintainer Reviewed-by on v1 1/2
#2 lore raw
In reply to Carlos Llamas
Quoted 10 lines · Carlos Llamas

The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'.

Cc [email protected]
Fixes eafedbc7c050 ("rust_binder: add Rust Binder driver")
Reported-by kernel test robot <[email protected]>
Closes https://lore.kernel.org/r/[email protected]/ open here
Signed-off-by Carlos Llamas <[email protected]>

For both patches:

Reviewed-by Alice Ryhl <[email protected]>