+ kdev_t-shift-in-dev_t-in-mkdev.patch added to mm-nonmm-unstable branch

+ kdev_t-shift-in-dev_t-in-mkdev.patch added to mm-nonmm-unstable branch

[Andrew Morton]

The patch titled
     Subject: kdev_t: shift in dev_t in MKDEV()
has been added to the -mm mm-nonmm-unstable branch.  Its filename is
     kdev_t-shift-in-dev_t-in-mkdev.patch

This patch will shortly appear at
     https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/kdev_t-shift-in-dev_t-in-mkdev.patch

This patch will later appear in the mm-nonmm-unstable branch at
    git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next via various
branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there most days

------------------------------------------------------
From: Matthias Goergens <matthias.goergens@gmail.com>
Subject: kdev_t: shift in dev_t in MKDEV()
Date: Mon, 28 Sep 2026 06:49:58 +0800

MKDEV(ma, mi) evaluates ((ma) << MINORBITS) in whatever type the caller
passes, usually int.  For majors >= 2048 (legal: majors go up to 4095) the
result exceeds INT_MAX, which C11 leaves undefined for a signed left
shift; shifting a negative ma is undefined regardless of the major's
value.  In practice, on the compilers and two's complement targets the
kernel supports, both cases wrap to the intended bit pattern; this patch
makes the macro well defined regardless by casting the major to dev_t
before shifting.  For major and minor numbers in range, the device number
it produces is unchanged.

isofs feeds the Rock Ridge 'PN' entry's dev_high and dev_low into MKDEV()
while holding them in int variables (fs/isofs/rock.c), so a crafted image
can drive this exact shift.  Fixing the macro covers every caller instead
of just that one.

Link: https://lore.kernel.org/20260927224958.508964-1-matthias.goergens@gmail.com
Signed-off-by: Matthias Goergens <matthias.goergens@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jan Kara <jack@suse.cz>
---

 include/linux/kdev_t.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/kdev_t.h~kdev_t-shift-in-dev_t-in-mkdev
+++ a/include/linux/kdev_t.h
@@ -9,7 +9,7 @@
 
 #define MAJOR(dev)	((unsigned int) ((dev) >> MINORBITS))
 #define MINOR(dev)	((unsigned int) ((dev) & MINORMASK))
-#define MKDEV(ma,mi)	(((ma) << MINORBITS) | (mi))
+#define MKDEV(ma, mi)	(((dev_t)(ma) << MINORBITS) | (mi))
 
 #define print_dev_t(buffer, dev)					\
 	sprintf((buffer), "%u:%u\n", MAJOR(dev), MINOR(dev))
_

Patches currently in -mm which might be from matthias.goergens@gmail.com are

kdev_t-shift-in-dev_t-in-mkdev.patch