From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f74.google.com (mail-dl1-f74.google.com [74.125.82.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C64542F39A7 for ; Tue, 27 Jan 2026 23:55:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769558159; cv=none; b=tXPRiJ+QmNSDMQDBIXfPaKb75ItMdsr8zwdDMKb07G6144xNbHhBtMi++Gi+pB+mNd4D6rcKnsA2F0K2Dhhe2cHISo41PfWFRUIiSeUM4opcO6+C8xK9KC+netIpgiTu2wf+QZyK79JxvyU0HKuAdd1BMHCaGH3wGc4zhrDO+3k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769558159; c=relaxed/simple; bh=1bdvDWy3ayORJJpYAh61pTdmvx/lpSGKvlPrNdsqbzE=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=OfV9Avlm0uEPM2kso4dMXnP2Rcd+LgW94dkwexPEmP6Gs50xy6AvjUIrQNtJ4Wg1GyHFbeCwt9igi6uK5gbvLu8bWierIyct3CqlEpfYW3IGuAW3w5SDAjOIHDTtSd6mCHoky3XKQOTa6m30S7c3GTaGAV3ixagvrh6UOc8JoIs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=XDfkmBEA; arc=none smtp.client-ip=74.125.82.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="XDfkmBEA" Received: by mail-dl1-f74.google.com with SMTP id a92af1059eb24-1248da4d2d6so5036778c88.0 for ; Tue, 27 Jan 2026 15:55:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1769558156; x=1770162956; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=tdCSuV7lwZVI5Oxf115A/DnTg8grqC5WgVzeqsLUVUc=; b=XDfkmBEAqTlQbG+DHKMGgirINNHy1Dw+bSzPjATWlqvfxaFOY4uxSWoCpG94bFJJXJ DsGuH0by0Xh4Cfo2Q87gmBBb9uZAvUU2+oftoJuVB+Po8SKUafM1jY0AFqxffFhBC9yq OdNSU8LilWGKHg2Ea1g7XsGuXMh1na63HzQbyeDqBTUPdurlQPt6TOtSDLgWCzRulRma phDeVw5kDuop3D+ygstKo16cAo56hdnCdIhn4aW0KnCTjMtsoURY5Se+4EWOfY7HGVQc nLYLbLrmvIcdvvmIDURuaQ/OCO14r1ZC4y1YWx0t4vbttLMMZEdQuVYfZQEfHS+crz0J L1XQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769558156; x=1770162956; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=tdCSuV7lwZVI5Oxf115A/DnTg8grqC5WgVzeqsLUVUc=; b=jJfoxeEguvLi69p0u6wTmqEvHLufIMVqeOOpO7QOrLv41nymnv1rk1qHTxfEeVEQPW 9AsaNdVmlz8q4WyHRKPZai7UHUWwalpSIj9OcmWpT4STvoFbTgejKlBWIN1g0Ew/azwk BeGXE8b2giNcZvoy2JDEx7Q9+T+SXwpY38LXVzfnhsCHCboPQ3No935wlSGgThUIr0R6 ptyxENZU3nhqvWOQLX1Bd2W3Ho9PDS4hKPu0tcSKvKzqwSaGqeBD5fWT1ZZhaGsYlamo N1+1Kabt6JHm/Ww0ECeDcsaHLhuIeOV/EOQCvwtc3TC3fBIN+DQauv4C7i3tfFSwDV7M goJQ== X-Forwarded-Encrypted: i=1; AJvYcCX1WK4vi2tJvhspTt2gT6G3Xho7dr9d1hWH6RfjDfgfM9uFNjnGtA+34BcVVT2FmQ1/5ZJDesOOceLnfAA=@vger.kernel.org X-Gm-Message-State: AOJu0Yzl73T+RR1k6XP8Avz183UFaZLwfLzNESeZMZqX+TTgT3jP0xIt lVgX2ZQPEDqXovy8FjB1IGpzHxW1Hl7S+HXKGiZfgQEobRG+NS+KaW+MDy1++AxSFZvh/31EDEj pEuMyyLfkqX+fgw== X-Received: from dltt2.prod.google.com ([2002:a05:701a:c962:b0:119:78ff:fe10]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:24a9:b0:119:e55a:9c08 with SMTP id a92af1059eb24-124a0114330mr1992149c88.36.1769558155760; Tue, 27 Jan 2026 15:55:55 -0800 (PST) Date: Tue, 27 Jan 2026 23:55:10 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260127235545.2307876-1-cmllamas@google.com> Subject: [PATCH 1/2] rust_binderfs: fix ida_alloc_max() upper bound From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl , Dmitry Antipov , Al Viro , NeilBrown , Matt Gilbride , Wedson Almeida Filho , Li Li , Paul Moore Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org, kernel test robot Content-Type: text/plain; charset="UTF-8" The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202512181203.IOv6IChH-lkp@intel.com/ Signed-off-by: Carlos Llamas --- drivers/android/binder/rust_binderfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c index c69026df775c..88374b31ab7c 100644 --- a/drivers/android/binder/rust_binderfs.c +++ b/drivers/android/binder/rust_binderfs.c @@ -132,8 +132,8 @@ static int binderfs_binder_device_create(struct inode *ref_inode, mutex_lock(&binderfs_minors_mutex); if (++info->device_count <= info->mount_opts.max) minor = ida_alloc_max(&binderfs_minors, - use_reserve ? BINDERFS_MAX_MINOR : - BINDERFS_MAX_MINOR_CAPPED, + use_reserve ? BINDERFS_MAX_MINOR - 1 : + BINDERFS_MAX_MINOR_CAPPED - 1, GFP_KERNEL); else minor = -ENOSPC; @@ -405,8 +405,8 @@ static int binderfs_binder_ctl_create(struct super_block *sb) /* Reserve a new minor number for the new device. */ mutex_lock(&binderfs_minors_mutex); minor = ida_alloc_max(&binderfs_minors, - use_reserve ? BINDERFS_MAX_MINOR : - BINDERFS_MAX_MINOR_CAPPED, + use_reserve ? BINDERFS_MAX_MINOR - 1 : + BINDERFS_MAX_MINOR_CAPPED - 1, GFP_KERNEL); mutex_unlock(&binderfs_minors_mutex); if (minor < 0) { -- 2.52.0.457.g6b5491de43-goog