Fix three security and resource-accounting issues in `binder_netlink.c`
and `binderfs.c`:

1. In `drivers/android/binder_netlink.c`,
   `binder_nl_mcgrps[BINDER_NLGRP_REPORT]` is declared without `.flags =
   GENL_MCAST_CAP_NET_ADMIN`, allowing any unprivileged local user to
   subscribe to the `BINDER_NLGRP_REPORT` Generic Netlink multicast
   group and monitor system-wide binder transaction error reports
   (including sender/target PIDs and transaction metadata).
2. In `drivers/android/binderfs.c`, `binderfs_binder_ctl_create()`
   allocates an IDA minor via `ida_alloc_max(&binderfs_minors, ...)`,
   and if `d_alloc_name(root, "binder-control")` fails, jumps to `out:`
   (which calls `kfree(device)`) without freeing `minor` from
   `binderfs_minors`.
3. When the `binder-control` inode (`device->context.name == NULL`) is
   evicted in `binderfs_evict_inode()`, `--info->device_count` is
   decremented even though `binderfs_binder_ctl_create()` never
   incremented `info->device_count`, underflowing `info->device_count`.
   Only decrement `info->device_count` when `device->context.name` is
   non-NULL.

Fixes: 63740349eba7 ("binder: introduce transaction reports via netlink")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 drivers/android/binder_netlink.c | 2 +-
 drivers/android/binderfs.c       | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/android/binder_netlink.c b/drivers/android/binder_netlink.c
index 81e8432b5904..3f1a4210aa52 100644
--- a/drivers/android/binder_netlink.c
+++ b/drivers/android/binder_netlink.c
@@ -16,7 +16,7 @@ static const struct genl_split_ops binder_nl_ops[] = {
 };
 
 static const struct genl_multicast_group binder_nl_mcgrps[] = {
-	[BINDER_NLGRP_REPORT] = { "report", },
+	[BINDER_NLGRP_REPORT] = { "report", .flags = GENL_MCAST_CAP_NET_ADMIN },
 };
 
 struct genl_family binder_nl_family __ro_after_init = {
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 361d69f756f5..661fda3ecb59 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -258,7 +258,8 @@ static void binderfs_evict_inode(struct inode *inode)
 		return;
 
 	mutex_lock(&binderfs_minors_mutex);
-	--info->device_count;
+	if (device->context.name)
+		--info->device_count;
 	ida_free(&binderfs_minors, device->miscdev.minor);
 	mutex_unlock(&binderfs_minors_mutex);
 
@@ -430,8 +431,12 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 	device->miscdev.minor = minor;
 
 	dentry = d_alloc_name(root, "binder-control");
-	if (!dentry)
+	if (!dentry) {
+		mutex_lock(&binderfs_minors_mutex);
+		ida_free(&binderfs_minors, minor);
+		mutex_unlock(&binderfs_minors_mutex);
 		goto out;
+	}
 
 	inode->i_private = device;
 	info->control_dentry = dentry;

On Sat, Sep 19, 2026 at 09:36:54PM +0000, Hui Peng wrote:
> Fix three security and resource-accounting issues in `binder_netlink.c`
> and `binderfs.c`:
> 
> 1. In `drivers/android/binder_netlink.c`,
>    `binder_nl_mcgrps[BINDER_NLGRP_REPORT]` is declared without `.flags =
>    GENL_MCAST_CAP_NET_ADMIN`, allowing any unprivileged local user to
>    subscribe to the `BINDER_NLGRP_REPORT` Generic Netlink multicast
>    group and monitor system-wide binder transaction error reports
>    (including sender/target PIDs and transaction metadata).

Yeap, the whole point is for selinux approved processes to subscribe to
these reports.

> 2. In `drivers/android/binderfs.c`, `binderfs_binder_ctl_create()`
>    allocates an IDA minor via `ida_alloc_max(&binderfs_minors, ...)`,
>    and if `d_alloc_name(root, "binder-control")` fails, jumps to `out:`
>    (which calls `kfree(device)`) without freeing `minor` from
>    `binderfs_minors`.

This is already fixed by:
https://lore.kernel.org/all/tencent_8D7B76C623DA3A29EE73D38217ACB08AFB09@qq.com/

> 3. When the `binder-control` inode (`device->context.name == NULL`) is
>    evicted in `binderfs_evict_inode()`, `--info->device_count` is
>    decremented even though `binderfs_binder_ctl_create()` never
>    incremented `info->device_count`, underflowing `info->device_count`.
>    Only decrement `info->device_count` when `device->context.name` is
>    non-NULL.

I haven't looked closely at this one but it sounds like a real issue.
However, it would still need to be a separate patch, so please drop the
rest and please use the appropriate `Fixes:` tag.

Note this code has now been removed, but we may need to take the fix for
stable and downstream Android branches.

Thanks,
Carlos Llamas

On Sat, Sep 19, 2026 at 09:36:54PM +0000, Hui Peng wrote:
> Fix three security and resource-accounting issues in `binder_netlink.c`
> and `binderfs.c`:
> 
> 1. In `drivers/android/binder_netlink.c`,
>    `binder_nl_mcgrps[BINDER_NLGRP_REPORT]` is declared without `.flags =
>    GENL_MCAST_CAP_NET_ADMIN`, allowing any unprivileged local user to
>    subscribe to the `BINDER_NLGRP_REPORT` Generic Netlink multicast
>    group and monitor system-wide binder transaction error reports
>    (including sender/target PIDs and transaction metadata).
> 2. In `drivers/android/binderfs.c`, `binderfs_binder_ctl_create()`
>    allocates an IDA minor via `ida_alloc_max(&binderfs_minors, ...)`,
>    and if `d_alloc_name(root, "binder-control")` fails, jumps to `out:`
>    (which calls `kfree(device)`) without freeing `minor` from
>    `binderfs_minors`.
> 3. When the `binder-control` inode (`device->context.name == NULL`) is
>    evicted in `binderfs_evict_inode()`, `--info->device_count` is
>    decremented even though `binderfs_binder_ctl_create()` never
>    incremented `info->device_count`, underflowing `info->device_count`.
>    Only decrement `info->device_count` when `device->context.name` is
>    non-NULL.

Why isn't this 3 different patches?

thanks,

greg kh