From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out162-62-58-216.mail.qq.com (out162-62-58-216.mail.qq.com [162.62.58.216]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E5932EB874 for ; Tue, 11 Aug 2026 01:05:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.62.58.216 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786410345; cv=none; b=CsGuvxJCM57pnSgjVGTRqX7MWqkaVkBv0PoR5k6x5O02MerwEHc4779axmOvT+aaux4tTEgQ1HlcX7gPyeruSTW/GMsE7qGiHbW8nyxuff6EpG9C5mh7SLIGNW5qCm0/Y5ygMkuhhvyf28JsjBApGBWS2D2VpgOR1Kc2b0Qbkqw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786410345; c=relaxed/simple; bh=9kK+9vTCa49KjvHfFg0Nl3bMZqpFHA3PHvGu3C/TY5g=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=FPAX/tp815YOJPtVSUl6KTbQiBVsRwBuCrJc5ha9xBP2nIBV92/PQqS+2Kg2lofIAEPsPkNArF8A5AXttooTykby/Q2si3Ijckqqr+MsTFjJ8QlI8Z+AczQzC01ipk4IzfKioANs6F+HE/cfmh2q3v8+mh0cLGChrrIAmww7EN8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=V7EqIbeD; arc=none smtp.client-ip=162.62.58.216 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="V7EqIbeD" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1786410337; bh=USu+yjBx4XEYU34WHvT5z+IokCrvoakEN3p6pfYlsZ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=V7EqIbeDfY2u9AQQYlGtMgNEeG0Q/6A0ArejNI2aKJAuBRlYA1KuaBTn2Rv3Z/VFL 55gszOb3YDYZ+nEHgRH/7fHjtLQNGH/gKTAMnxDFiaqBKucsC+Df5/Zz48ifSAysgd zJ1lAlBys+SJ/YraTXJC5OOK7MSOdUossMWX/p3c= Received: from localhost.localdomain ([116.128.244.169]) by newxmesmtplogicsvrsza73-0.qq.com (NewEsmtp) with SMTP id 162A8C4F; Tue, 11 Aug 2026 09:05:34 +0800 X-QQ-mid: xmsmtpt1786410334tq52ma16r Message-ID: X-QQ-XMAILINFO: OOO9dHjlsLs75ErFkluZsh92lm8JR1dv3agRKMdUUHgy/TXdpRgZB1W8yPcQ8u dGsc4Y4+BsrvItJ2qyNjZxqVVRlQ87nlqeCTr18h6t226TItCFmfFOn1/Ngha8vm/JttqsWoKJwV ws7pyd3/LSBFo1ncp28UjbHJtbjx8vLJv16qYAYCYCFJTy+busH/56Xc9KVWM3QOVB7g/p56uY5v VOoOc8JFdSPqOhECD3nPOWhUKp08Xq8Zb/iPuQlXZ0e+dFegm8GD3vBSruuqj2UJERgnrC3xFdmg 1kjjSpJLNnbMyc+yzIHSNYrRFnTYzpcrGhEG4jdMZwfC5jczjEFPhMNRA6qIRR4osNNbIkTbX1VT 9zD+is5moKk9F3HR31cNSoxdgDykRmKlUon2xK51FptAWqga8QG0MvhuYi/oskWgSpwwpo2ehmHS CxWJtFHhJG7vz4zxjDhS6T+MFlDojPRuC+wqK5icddm7ccLAOmNkJ7p1Lp97jdcF1SzCg56KHvgc L4FoXpSPQ1h7dw0RLDEH8jK2m8lQhyAWpq2MyJuXgSWSf+mhy0jRcXmajkqGu5TPyXZxWXRttIBX spFjJJXEeofd+eRsPAsShu6xcrZFfPORJ5exuUIFzrAM/6jKW7cM4VtSTGc5JeQgHvW/2KoPloAB j2wrMoRKvfuIhS0pBknhumiu9Iz1LB8EeNZEqmX4Nnn5colJFJPaUa3KvCKay2zd4GPsCz510PeE 1c6BU+DB7OvUFFc2NkrExopHN02WrT94aYEcNxpEv9oHSuPPjb6UUMlMs3DgSA2gyxVo3nsvro3m Zx2BBba+zavdRx4zFeZ5O3NsLQ4oV1pyAVyHo7WP1qqxUtK7eHLYnFYLVx+SzcTH6fkbOQgqEFZl oc/g1QYN1/HolN/4u+uKLyuM53wVBCFccKXZ6plS0NwVYtVOI9FQEeYB7S70GrD1b2zqi7dRWi8S JRravVs+y1PUqkfeyiEOwXpSjrf79x2Rf1IBj+f02Klc/imbDGosKjAHQMGXPh X-QQ-XMRINFO: OD9hHCdaPRBwH5bRRRw8tsiH4UAatJqXfg== From: Chao Huang <958028483@qq.com> To: Carlos Llamas Cc: Alice Ryhl , Greg Kroah-Hartman , =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= , Todd Kjos , Christian Brauner , linux-kernel@vger.kernel.org, Chao Huang Subject: [PATCH v3] binderfs: free minor on binder-control creation failure Date: Tue, 11 Aug 2026 09:05:34 +0800 X-OQ-MSGID: <20260811010534.76975-1-958028483@qq.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Chao Huang Both binderfs_binder_ctl_create() implementations allocate a minor before creating the binder-control dentry. If d_alloc_name() fails, the error path frees the device and drops the inode, but leaves the minor allocated in binderfs_minors. Repeated failures can therefore exhaust the global minor IDA. Release the minor from a dedicated error path after a successful allocation in both implementations. Signed-off-by: Chao Huang --- Changes in v3: - Use a dedicated out_with_minor error path instead of an -ENOSPC sentinel. drivers/android/binder/rust_binderfs.c | 7 ++++++- drivers/android/binderfs.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c index ade1c4d92499..0763e3db54bd 100644 --- a/drivers/android/binder/rust_binderfs.c +++ b/drivers/android/binder/rust_binderfs.c @@ -421,7 +421,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb) dentry = d_alloc_name(root, "binder-control"); if (!dentry) - goto out; + goto out_with_minor; inode->i_private = device; info->control_dentry = dentry; @@ -430,6 +430,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb) return 0; +out_with_minor: + mutex_lock(&binderfs_minors_mutex); + ida_free(&binderfs_minors, minor); + mutex_unlock(&binderfs_minors_mutex); + out: kfree(device); iput(inode); diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c index 361d69f756f5..0e96146ecf69 100644 --- a/drivers/android/binderfs.c +++ b/drivers/android/binderfs.c @@ -431,7 +431,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb) dentry = d_alloc_name(root, "binder-control"); if (!dentry) - goto out; + goto out_with_minor; inode->i_private = device; info->control_dentry = dentry; @@ -440,6 +440,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb) return 0; +out_with_minor: + mutex_lock(&binderfs_minors_mutex); + ida_free(&binderfs_minors, minor); + mutex_unlock(&binderfs_minors_mutex); + out: kfree(device); iput(inode); base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86 -- 2.25.1