From nobody Tue Sep 29 09:09:21 2026 Received: from out203-205-221-155.mail.qq.com (out203-205-221-155.mail.qq.com [203.205.221.155]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E0F483A257E for ; Mon, 10 Aug 2026 09:32:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.155 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786354351; cv=none; b=MmpHHwcE6QF0y3qdzb1xNvAmYBmE95bFhAUVkIjyqwrqSRC1xu6omX9+dsrDkat+sED+P8+fPlmCBjfpdNuQmJ02/mPjeaMkcsCiipTJuD6QS34gDHtM9HLQ2x/8IiP8BfJKJGyyYXxM1jGNVKSu0SwuQL33wEtsj15AKqrQHYM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786354351; c=relaxed/simple; bh=2yLbsQGdm4cyaShmYPxJ39qp7CRr99u9F7wdAjz58Jk=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=TEP4BvAw4KorKYnDddpHImmtMkYMdgh3aq86+IIce1NcOmLRwPmfKzxgZmjOrOqZE/oNDWqyWMwYabJL5VXEv/3bE9Zfd7PsqJts4K94mGBohSxOFhPU9slMUAmmLa9oFOs8Cu00De5SiMWQsRUCCrU1PtCLQFCdIIzVvbgoR5w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=g4iDfrWF; arc=none smtp.client-ip=203.205.221.155 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="g4iDfrWF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1786354339; bh=CsXBQGzEh2ZV5rUgiRizRAFCpT9nEoAD+q2w2y1uvUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=g4iDfrWFoIre/okhinGbtJjo4WaDIr/6FD0RklMXgs5nzW3Phx/aH+RAR3IpQAyUo tsxRVaRHnAD6ZUYoRqjOwpRUF0kSSnfc/xASaGiTGBP4SKjBSL0RX9WWA4jw0Yzm+Q an2of/+B+a5c/s5kkuFD11C9KT7F6jssmyOgCJZ8= Received: from localhost.localdomain ([116.128.244.169]) by newxmesmtplogicsvrszb51-0.qq.com (NewEsmtp) with SMTP id 810884CC; Mon, 10 Aug 2026 17:32:16 +0800 X-QQ-mid: xmsmtpt1786354336tku5k6n33 Message-ID: X-QQ-XMAILINFO: NmRjDopJZVxOrMAJhU2mmzYEZbpUxeSqNxq1Wn59qQpZypnC9Ya46kVmY2goyO EqdJOwQV5uc+mlfbPjDBtF7YwYehklAlfPaw70Js0Vgpm6lM+X6IMTnVPOKZTLXmtoGLVRk3zEyI movJKlZfSiaWcS5zpW/6imuNr+VV/TiLbU9P9TQHfnZ8h/jkKDfdNUWFdSV/0Bsaassw9aNKWuiK qeiWKVwCyLSufqiXQpF/gB2Xf4T2Ws7c5HD4wAAFdztIbuwtUWn85cvMTGxNxxgLj8AsLNz9q5N/ mXXjLN/TqIt230XJ9N5eUs+eN27jytjkw4BlH4/XMmEr6tEeJQuf6kheSl8PgZLdD4g7oT5Rw325 PXIqXIC3E1tsaVGqeS5yXJ4wyitc8rR5t/SXN5oUpvxGV5zM9gWfjLnRbVkojwOvFHnEmgc2eABP w0A24IxH6p2cKjiZjjBzVNqlZKcFjHJo6SQ3lRNmJBJB+1gy6BpCGjzDvK7uN/p76YY7YOr9lpGI FZ+HP7TvM0CDxhutcADAxNlGzPWjfNIXGmR90GLSCcsH5A5CXJMri2bDNpzyodryJgzn4X+8MEEv VVbCNlB9au3IaCgyZ5YQQBHg5TnlH6dV0z7k/2l2ANPPEWKaje3FsP76ktSZpdVZhoknSztea4gU nSq1Y0fLWFh3J7V415oPFXQu6ztVYyjLmk1ZI1a9rmNHZZotUB6gChUGlsxQ+DE8d1xeYuZaR+k1 uDdwxyE3CFo6RTISC1ZX7hUlBm16yZ3SUqV6nEKn3Sjv+4Agn8ebPLSWw6qy0i4WxcSaqFOrbeRH ePKOVVzoXObk5kv77piPRRQ8Bz/i5UbRPNa9wfaN68GMrPK0AL/P4gA7FAQ0z/XbQLEEewsKoVKo 2V5y7R4ecNglAyBUZg1dTCYgRwVvVfmmFecgE0sba05NYqy4L/DTqyGUisDgX2cvt+kQYgKSJJXm cnmyIEc2ylkPgNJ+LTb5TYSc/T2fqCEqCUgzCkTx4E86qbHTrrtAkfB3kq1yc5 X-QQ-XMRINFO: OWPUhxQsoeAVwkVaQIEGSKwwgKCxK/fD5g== From: Chao Huang <958028483@qq.com> To: Alice Ryhl Cc: Carlos Llamas , Greg Kroah-Hartman , =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= , Todd Kjos , Christian Brauner , linux-kernel@vger.kernel.org, Chao Huang Subject: [PATCH v2] binderfs: free minor on binder-control creation failure Date: Mon, 10 Aug 2026 17:32:16 +0800 X-OQ-MSGID: <20260810093216.582362-1-958028483@qq.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chao Huang Both binderfs_binder_ctl_create() implementations allocate a minor before creating the binder-control dentry. If d_alloc_name() fails, the error path frees the device and drops the inode, but leaves the minor allocated in binderfs_minors. Repeated failures can therefore exhaust the global minor IDA. Initialize minor to an invalid value and release it from the common error path after a successful allocation in both implementations. Signed-off-by: Chao Huang --- Changes in v2: - Apply the same fix to drivers/android/binder/rust_binderfs.c. drivers/android/binder/rust_binderfs.c | 7 ++++++- drivers/android/binderfs.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binde= r/rust_binderfs.c index ade1c4d92499..c65a8e514986 100644 --- a/drivers/android/binder/rust_binderfs.c +++ b/drivers/android/binder/rust_binderfs.c @@ -375,7 +375,7 @@ static const struct file_operations binder_ctl_fops =3D= { */ static int binderfs_binder_ctl_create(struct super_block *sb) { - int minor, ret; + int minor =3D -ENOSPC, ret; struct dentry *dentry; struct binder_device *device; struct inode *inode =3D NULL; @@ -431,6 +431,11 @@ static int binderfs_binder_ctl_create(struct super_blo= ck *sb) return 0; =20 out: + if (minor >=3D 0) { + mutex_lock(&binderfs_minors_mutex); + ida_free(&binderfs_minors, minor); + mutex_unlock(&binderfs_minors_mutex); + } kfree(device); iput(inode); =20 diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c index 361d69f756f5..fdbf281d3418 100644 --- a/drivers/android/binderfs.c +++ b/drivers/android/binderfs.c @@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops =3D= { */ static int binderfs_binder_ctl_create(struct super_block *sb) { - int minor, ret; + int minor =3D -ENOSPC, ret; struct dentry *dentry; struct binder_device *device; struct inode *inode =3D NULL; @@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_blo= ck *sb) return 0; =20 out: + if (minor >=3D 0) { + mutex_lock(&binderfs_minors_mutex); + ida_free(&binderfs_minors, minor); + mutex_unlock(&binderfs_minors_mutex); + } kfree(device); iput(inode); =20 base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86 --=20 2.25.1