From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dl1-f73.google.com (mail-dl1-f73.google.com [74.125.82.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA9902F6594 for ; Tue, 27 Jan 2026 23:55:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769558161; cv=none; b=QWfLV+5WJikzilp+bXP2b3fZvm3FOoGVlHO9YZ32N4oexifIF4pt42qXOiZy65VCHPnBarXkz/n+TAxNIugWjKzQPcZJvjvu2Htb+0zeonraPqITXSbFr2q1SvVX8LQvNYajohf2BQcKR/33zIlQg+zgv+w4u8T2pxNkeaadbzo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769558161; c=relaxed/simple; bh=/wdPWngeWyqtaO3ZuYpGrqfLIHmKv4UBTmrmnHj8DMg=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=JYFmUpW/KQLwRezetxgF1hYhiJKbWT1TqeTumdGCn1FWvO+G0d7gXyeBYzeCaKnMgmVnCBfgwBCI/3ktlDwpmXlOrb2gB2woQ6Mhp0+Zt7LlEQaV4BdYrUPj3kmTW/g1PNJIUcXA+D7Vl4R2cGxg+cIBFHYl5Hfl2L3RdjKEbtY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=OhvuNjPR; arc=none smtp.client-ip=74.125.82.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="OhvuNjPR" Received: by mail-dl1-f73.google.com with SMTP id a92af1059eb24-124aa710af7so124844c88.1 for ; Tue, 27 Jan 2026 15:55:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1769558159; x=1770162959; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=Ec41m/3W2IRBvp4aICfoAibwYrvXDMhUzyetw+v5spU=; b=OhvuNjPRSehNnhfp1dL5KA/vXoPNyaCD3LBzbIcLg6DYybSZdnqm0Qsyj0WJ0QTxp8 zDJNkQXXp7isxl38xUkvsYYkm3eTsxfcaMl9zcT7hsd574SlaWzod/NEq7DQR8UCPOBa CIGxUJRV3jxGW/fqSCRPmr+yR6BfWRVICBy0SsQ5wHYAFdaBzApFCYIcYCa7pJZLqpgC D76b5i4hsg5BTvuxz9riA4OBXYCgJf+9wiu8eTwcJl4GU4ykeVNK9lKG41M02ZfxwtRI urSdCHjCQ+7doCpoZCwMJj7NTJ2UCEcdlm9cu29POJDKYjtia5z9x4KPn0SrLFN97F39 yCHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1769558159; x=1770162959; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Ec41m/3W2IRBvp4aICfoAibwYrvXDMhUzyetw+v5spU=; b=xO5hMGnCqzo4pCU3LJpJ5YHgNr8CeJcQKusCaUVafg8lid23Vs5Yw9tKIBCXMEivDw CM5eBJ8I15pPe9CgqBb9Jr56fyuxJoQq8Rs8shJV3Vo5JhpmD2F9KLSdCEPaGdDpboAh fGRP1Q97yqc6F+UbIH4KBunh47XhZvExObsVuaRH4RZSCgVc+XB6UM3yw3uwgnBJxoH5 aLI8fz8tvppzBdujIGzAJ59gLHlpn/5/4dwNj5dwK5xFGi5V/kv+cr7SL4pPBQyz4/l1 JDICZAO459Hgj+vyeE3/YCjSNfOtwXUo6atWBE1PGfDGnvF3mo0C9DEmRkl3ushRXUqU ZfRg== X-Forwarded-Encrypted: i=1; AJvYcCVXXoAD7kI1nKkR9xpbNud28v9x4futkdnnZsA9fJJSAeDHIl8Kp36SFvpN5ZGWCss/I8ZHCeQjY8Ewk34=@vger.kernel.org X-Gm-Message-State: AOJu0YyMiCssl3o6zhvmYI8ziTh2mVU/ER+B/LdImO9fv5b/PkJ2BwNq NZiZBdfrNITaRQVvvc8gJ1rULmy9uuRjSlFX3Xq/0d6hKQKUFhqKFm7KTmQkr+QfJ2rXiHCQUoU DgMfIBVMnRwFw+w== X-Received: from dlbdt16.prod.google.com ([2002:a05:7022:2590:b0:123:2738:ba99]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:218:b0:119:e56b:958c with SMTP id a92af1059eb24-124a006a51bmr1779660c88.17.1769558158889; Tue, 27 Jan 2026 15:55:58 -0800 (PST) Date: Tue, 27 Jan 2026 23:55:11 +0000 In-Reply-To: <20260127235545.2307876-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260127235545.2307876-1-cmllamas@google.com> X-Mailer: git-send-email 2.52.0.457.g6b5491de43-goog Message-ID: <20260127235545.2307876-2-cmllamas@google.com> Subject: [PATCH 2/2] binderfs: fix ida_alloc_max() upper bound From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Todd Kjos Content-Type: text/plain; charset="UTF-8" The 'max' argument of ida_alloc_max() takes the maximum valid ID and not the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor would exceed the limits of minor numbers (20-bits). Fix this off-by-one error by subtracting 1 from the 'max'. Cc: stable@vger.kernel.org Fixes: 3ad20fe393b3 ("binder: implement binderfs") Signed-off-by: Carlos Llamas --- drivers/android/binderfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c index b46bcb91072d..9f8a18c88d66 100644 --- a/drivers/android/binderfs.c +++ b/drivers/android/binderfs.c @@ -132,8 +132,8 @@ static int binderfs_binder_device_create(struct inode *ref_inode, mutex_lock(&binderfs_minors_mutex); if (++info->device_count <= info->mount_opts.max) minor = ida_alloc_max(&binderfs_minors, - use_reserve ? BINDERFS_MAX_MINOR : - BINDERFS_MAX_MINOR_CAPPED, + use_reserve ? BINDERFS_MAX_MINOR - 1 : + BINDERFS_MAX_MINOR_CAPPED - 1, GFP_KERNEL); else minor = -ENOSPC; @@ -408,8 +408,8 @@ static int binderfs_binder_ctl_create(struct super_block *sb) /* Reserve a new minor number for the new device. */ mutex_lock(&binderfs_minors_mutex); minor = ida_alloc_max(&binderfs_minors, - use_reserve ? BINDERFS_MAX_MINOR : - BINDERFS_MAX_MINOR_CAPPED, + use_reserve ? BINDERFS_MAX_MINOR - 1 : + BINDERFS_MAX_MINOR_CAPPED - 1, GFP_KERNEL); mutex_unlock(&binderfs_minors_mutex); if (minor < 0) { -- 2.52.0.457.g6b5491de43-goog