From nobody Fri Oct 2 01:10:35 2026 Received: from xmbghk7.mail.qq.com (xmbghk7.mail.qq.com [43.163.128.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7B4F43B493 for ; Thu, 6 Aug 2026 11:23:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=43.163.128.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786015437; cv=none; b=GEY3rCWjXjvuDwmt5S6l3epMRR5H5q0qkQ60RFUIGnfjwxbLfQfZ+vi2w1E9R5U5HRXLcvYbA7vR/yHZ4HPmVAeJdHfRdwLZzgXAO/ywk5elnjOvTb09ieLWnV7rMi3QclVcWqS9b8UShYNfet7v+G7Ex4dkeNlIVxU7nBDS5Io= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786015437; c=relaxed/simple; bh=IZu8fsVZ+AseoDuCVQSkb8ohQXWanwG1DcVrizM6RmE=; h=Message-ID:From:To:Cc:Subject:Date:MIME-Version; b=JMPAiMSYMV8hfCeCT8sQsXlydNYLYcjohPMePfEtTMQt+KabDM1De+VE5O/7XuuIPQvzl8zRhWJq4n7KzZFabsRkdpoKr7LrI6Sbg57zHYNIs7OzMZ+2ho//jiRUgeBz/VuWpSJZf/zH/doXsSQATDXt+Y5Sk6SZsM5dVrct0k0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=Ns2KrSV2; arc=none smtp.client-ip=43.163.128.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="Ns2KrSV2" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1786015421; bh=7XePZccyJ0nHeRFnVjklz99qXYCPaiewlTpG4d5G6Ek=; h=From:To:Cc:Subject:Date; b=Ns2KrSV2uqbZTXBInL5flmUx03ff8ZiaRVCeNsBdDu4+50cvXY3xY1cBSODnPUc6t VLbpy5K9Hy/QISuJDVfGT0KUTr3u8GCBH4YMlE25ykTWHQKUdFDpFd5rwrqDl2lEeR T9s3XEV2SdlZ1aVBBRhODqn3FYsrHYfL+nO2Vl6k= Received: from localhost.localdomain ([116.128.244.169]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id 5E6BCAFD; Thu, 06 Aug 2026 19:23:38 +0800 X-QQ-mid: xmsmtpt1786015418tmnafz2dh Message-ID: X-QQ-XMAILINFO: NwU6Bou9okj/iSNhw94IREarB/sf+9iNO9R7gAps9r5ln9VVPcnddaRh7brPUv Pt/RfRGKnqhY3TDpqBGPa3sR/ki6oqKXbzik35cef96HTbN98Mz47hMEX2CWyhf3iNt+yocrBAeu o47exdOkLJ9bHiIhQTs1sap2tue8UYLjHXIoIe3Aw+t6K3n/p4ki3A8zxfiSZKHydlFfdLz8jDw1 F58QJ4DbPsWndiB0dxMnazc1WbQbmDkwPYtIIdxXyXoIzRYnPfSO9/b4lg03+FLQ+2MwDjc/HBuf clw0HyIiwBJLLTIgU5vdh67DE4i36WRU2cUtLZ+D3OzuVOaqe1ysIWLgnBq7f2cSOCx5ZwfzxJA7 SG6O/A0s2Tmol92IyJ7NKbpoCKzrQczBDH4EwzhszS1agBMxiuCaFpovN7w2f0YVj7t6Mff1TPmi HxGfAm/1Adt/P9NeYJLgCMcpuEzzv+aeZ6Y1eM7vK0gZalJgrjUssPQB/+wfJpKfz+sWXt2+aFtY 1sgH7cZYLPVrRHwoQ4snZJZCiboOIw8Oh/U5L/cOLZOFLmFp9tHMqQoNdg7An7spyqvyUB9dsQGj aeUJP4TuhqUjWI22rTZJ/t/IWHXe2rkL9K8BlQ91XCMYNts+rbJJsLiivlJmiQKLO7zTo0hF3GP0 w1CSU9DKsbjpA8gbuZACQCtCzYr+JCAnFJgXfP7vYbDt/mVEtGNvxAL0+TlUfVu4UVgaBfWts31F jWyMXirmRZGCKzVQ05xCUAhK0EVcgA/LBWX6Z2wvvkR8q79QhYcwNSdWgzVUNaTUicdWD4r1s94y W82oet7SkzJKmDh7PflQ0w3ufRH4WFeSQnGuvl15VrUDPjX8i0A7pZynJFrtbCDVfFZuclUvSAzx AAsLwwQrG8F5xpu4WWaoCprUCuRyrD1bI1scHtSsmVdA8xRjW/0TmLdK9WdeWfYlWZjvWDkm9Ire E7hAWmzya9tX9pobQtB6t7JZRfDP79JCz1CDYUw3twJEKFHPvNc8rytYvzm8TL2WfgZkhRzYY= X-QQ-XMRINFO: NI4Ajvh11aEjEMj13RCX7UuhPEoou2bs1g== From: Chao Huang <958028483@qq.com> To: Carlos Llamas , Greg Kroah-Hartman Cc: =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= , Todd Kjos , Christian Brauner , Alice Ryhl , linux-kernel@vger.kernel.org, Chao Huang Subject: [PATCH] binderfs: free minor on binder-control creation failure Date: Thu, 6 Aug 2026 19:23:38 +0800 X-OQ-MSGID: <20260806112338.888175-1-958028483@qq.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Chao Huang binderfs_binder_ctl_create() allocates a minor before creating the binder-control dentry. If d_alloc_name() fails, the error path frees the device and drops the inode, but leaves the minor allocated in binderfs_minors. Repeated failures can therefore exhaust the global minor IDA. Initialize minor to an invalid value and release it from the common error path after a successful allocation. Signed-off-by: Chao Huang --- drivers/android/binderfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c index 361d69f756f5..fdbf281d3418 100644 --- a/drivers/android/binderfs.c +++ b/drivers/android/binderfs.c @@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops =3D= { */ static int binderfs_binder_ctl_create(struct super_block *sb) { - int minor, ret; + int minor =3D -ENOSPC, ret; struct dentry *dentry; struct binder_device *device; struct inode *inode =3D NULL; @@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_blo= ck *sb) return 0; =20 out: + if (minor >=3D 0) { + mutex_lock(&binderfs_minors_mutex); + ida_free(&binderfs_minors, minor); + mutex_unlock(&binderfs_minors_mutex); + } kfree(device); iput(inode); =20 base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86 --=20 2.25.1