* [PATCH] binderfs: free minor on binder-control creation failure
@ 2026-08-06 11:23 Chao Huang
2026-08-08 13:34 ` Alice Ryhl
0 siblings, 1 reply; 6+ messages in thread
From: Chao Huang @ 2026-08-06 11:23 UTC (permalink / raw)
To: Carlos Llamas, Greg Kroah-Hartman
Cc: Arve Hjønnevåg, Todd Kjos, Christian Brauner,
Alice Ryhl, linux-kernel, Chao Huang
From: Chao Huang <huangchao@kylinos.cn>
binderfs_binder_ctl_create() allocates a minor before creating the
binder-control dentry. If d_alloc_name() fails, the error path frees the
device and drops the inode, but leaves the minor allocated in
binderfs_minors. Repeated failures can therefore exhaust the global minor
IDA.
Initialize minor to an invalid value and release it from the common error
path after a successful allocation.
Signed-off-by: Chao Huang <huangchao@kylinos.cn>
---
drivers/android/binderfs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 361d69f756f5..fdbf281d3418 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops = {
*/
static int binderfs_binder_ctl_create(struct super_block *sb)
{
- int minor, ret;
+ int minor = -ENOSPC, ret;
struct dentry *dentry;
struct binder_device *device;
struct inode *inode = NULL;
@@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
return 0;
out:
+ if (minor >= 0) {
+ mutex_lock(&binderfs_minors_mutex);
+ ida_free(&binderfs_minors, minor);
+ mutex_unlock(&binderfs_minors_mutex);
+ }
kfree(device);
iput(inode);
base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] binderfs: free minor on binder-control creation failure
2026-08-06 11:23 [PATCH] binderfs: free minor on binder-control creation failure Chao Huang
@ 2026-08-08 13:34 ` Alice Ryhl
2026-08-10 9:32 ` [PATCH v2] " Chao Huang
0 siblings, 1 reply; 6+ messages in thread
From: Alice Ryhl @ 2026-08-08 13:34 UTC (permalink / raw)
To: Chao Huang
Cc: Carlos Llamas, Greg Kroah-Hartman, Arve Hjønnevåg,
Todd Kjos, Christian Brauner, linux-kernel, Chao Huang
On Thu, Aug 06, 2026 at 07:23:38PM +0800, Chao Huang wrote:
> From: Chao Huang <huangchao@kylinos.cn>
>
> binderfs_binder_ctl_create() allocates a minor before creating the
> binder-control dentry. If d_alloc_name() fails, the error path frees the
> device and drops the inode, but leaves the minor allocated in
> binderfs_minors. Repeated failures can therefore exhaust the global minor
> IDA.
>
> Initialize minor to an invalid value and release it from the common error
> path after a successful allocation.
>
> Signed-off-by: Chao Huang <huangchao@kylinos.cn>
Thanks!
Please fix drivers/android/binder/rust_binderfs.c as well.
Alice
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] binderfs: free minor on binder-control creation failure
2026-08-08 13:34 ` Alice Ryhl
@ 2026-08-10 9:32 ` Chao Huang
2026-08-10 20:16 ` Carlos Llamas
0 siblings, 1 reply; 6+ messages in thread
From: Chao Huang @ 2026-08-10 9:32 UTC (permalink / raw)
To: Alice Ryhl
Cc: Carlos Llamas, Greg Kroah-Hartman, Arve Hjønnevåg,
Todd Kjos, Christian Brauner, linux-kernel, Chao Huang
From: Chao Huang <huangchao@kylinos.cn>
Both binderfs_binder_ctl_create() implementations allocate a minor before
creating the binder-control dentry. If d_alloc_name() fails, the error path
frees the device and drops the inode, but leaves the minor allocated in
binderfs_minors. Repeated failures can therefore exhaust the global minor
IDA.
Initialize minor to an invalid value and release it from the common error
path after a successful allocation in both implementations.
Signed-off-by: Chao Huang <huangchao@kylinos.cn>
---
Changes in v2:
- Apply the same fix to drivers/android/binder/rust_binderfs.c.
drivers/android/binder/rust_binderfs.c | 7 ++++++-
drivers/android/binderfs.c | 7 ++++++-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
index ade1c4d92499..c65a8e514986 100644
--- a/drivers/android/binder/rust_binderfs.c
+++ b/drivers/android/binder/rust_binderfs.c
@@ -375,7 +375,7 @@ static const struct file_operations binder_ctl_fops = {
*/
static int binderfs_binder_ctl_create(struct super_block *sb)
{
- int minor, ret;
+ int minor = -ENOSPC, ret;
struct dentry *dentry;
struct binder_device *device;
struct inode *inode = NULL;
@@ -431,6 +431,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
return 0;
out:
+ if (minor >= 0) {
+ mutex_lock(&binderfs_minors_mutex);
+ ida_free(&binderfs_minors, minor);
+ mutex_unlock(&binderfs_minors_mutex);
+ }
kfree(device);
iput(inode);
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 361d69f756f5..fdbf281d3418 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops = {
*/
static int binderfs_binder_ctl_create(struct super_block *sb)
{
- int minor, ret;
+ int minor = -ENOSPC, ret;
struct dentry *dentry;
struct binder_device *device;
struct inode *inode = NULL;
@@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
return 0;
out:
+ if (minor >= 0) {
+ mutex_lock(&binderfs_minors_mutex);
+ ida_free(&binderfs_minors, minor);
+ mutex_unlock(&binderfs_minors_mutex);
+ }
kfree(device);
iput(inode);
base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] binderfs: free minor on binder-control creation failure
2026-08-10 9:32 ` [PATCH v2] " Chao Huang
@ 2026-08-10 20:16 ` Carlos Llamas
2026-08-11 1:05 ` [PATCH v3] " Chao Huang
0 siblings, 1 reply; 6+ messages in thread
From: Carlos Llamas @ 2026-08-10 20:16 UTC (permalink / raw)
To: Chao Huang
Cc: Alice Ryhl, Greg Kroah-Hartman, Arve Hjønnevåg,
Todd Kjos, Christian Brauner, linux-kernel, Chao Huang
On Mon, Aug 10, 2026 at 05:32:16PM +0800, Chao Huang wrote:
> From: Chao Huang <huangchao@kylinos.cn>
>
> Both binderfs_binder_ctl_create() implementations allocate a minor before
> creating the binder-control dentry. If d_alloc_name() fails, the error path
> frees the device and drops the inode, but leaves the minor allocated in
> binderfs_minors. Repeated failures can therefore exhaust the global minor
> IDA.
>
> Initialize minor to an invalid value and release it from the common error
> path after a successful allocation in both implementations.
>
> Signed-off-by: Chao Huang <huangchao@kylinos.cn>
> ---
> Changes in v2:
> - Apply the same fix to drivers/android/binder/rust_binderfs.c.
>
> drivers/android/binder/rust_binderfs.c | 7 ++++++-
> drivers/android/binderfs.c | 7 ++++++-
> 2 files changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
> index ade1c4d92499..c65a8e514986 100644
> --- a/drivers/android/binder/rust_binderfs.c
> +++ b/drivers/android/binder/rust_binderfs.c
> @@ -375,7 +375,7 @@ static const struct file_operations binder_ctl_fops = {
> */
> static int binderfs_binder_ctl_create(struct super_block *sb)
> {
> - int minor, ret;
> + int minor = -ENOSPC, ret;
> struct dentry *dentry;
> struct binder_device *device;
> struct inode *inode = NULL;
> @@ -431,6 +431,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
> return 0;
>
> out:
> + if (minor >= 0) {
> + mutex_lock(&binderfs_minors_mutex);
> + ida_free(&binderfs_minors, minor);
> + mutex_unlock(&binderfs_minors_mutex);
> + }
> kfree(device);
> iput(inode);
>
> diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
> index 361d69f756f5..fdbf281d3418 100644
> --- a/drivers/android/binderfs.c
> +++ b/drivers/android/binderfs.c
> @@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops = {
> */
> static int binderfs_binder_ctl_create(struct super_block *sb)
> {
> - int minor, ret;
> + int minor = -ENOSPC, ret;
Why -ENOSPC?
> struct dentry *dentry;
> struct binder_device *device;
> struct inode *inode = NULL;
> @@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
> return 0;
>
> out:
> + if (minor >= 0) {
> + mutex_lock(&binderfs_minors_mutex);
> + ida_free(&binderfs_minors, minor);
> + mutex_unlock(&binderfs_minors_mutex);
> + }
How about a new "goto out_with_minor;" tag? This removes the odd ENOSPC
value and having to do this if (minor) check.
> kfree(device);
> iput(inode);
>
>
> base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v3] binderfs: free minor on binder-control creation failure
2026-08-10 20:16 ` Carlos Llamas
@ 2026-08-11 1:05 ` Chao Huang
2026-08-11 2:52 ` Carlos Llamas
0 siblings, 1 reply; 6+ messages in thread
From: Chao Huang @ 2026-08-11 1:05 UTC (permalink / raw)
To: Carlos Llamas
Cc: Alice Ryhl, Greg Kroah-Hartman, Arve Hjønnevåg,
Todd Kjos, Christian Brauner, linux-kernel, Chao Huang
From: Chao Huang <huangchao@kylinos.cn>
Both binderfs_binder_ctl_create() implementations allocate a minor before
creating the binder-control dentry. If d_alloc_name() fails, the error path
frees the device and drops the inode, but leaves the minor allocated in
binderfs_minors. Repeated failures can therefore exhaust the global minor
IDA.
Release the minor from a dedicated error path after a successful allocation
in both implementations.
Signed-off-by: Chao Huang <huangchao@kylinos.cn>
---
Changes in v3:
- Use a dedicated out_with_minor error path instead of an -ENOSPC sentinel.
drivers/android/binder/rust_binderfs.c | 7 ++++++-
drivers/android/binderfs.c | 7 ++++++-
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
index ade1c4d92499..0763e3db54bd 100644
--- a/drivers/android/binder/rust_binderfs.c
+++ b/drivers/android/binder/rust_binderfs.c
@@ -421,7 +421,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
dentry = d_alloc_name(root, "binder-control");
if (!dentry)
- goto out;
+ goto out_with_minor;
inode->i_private = device;
info->control_dentry = dentry;
@@ -430,6 +430,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
return 0;
+out_with_minor:
+ mutex_lock(&binderfs_minors_mutex);
+ ida_free(&binderfs_minors, minor);
+ mutex_unlock(&binderfs_minors_mutex);
+
out:
kfree(device);
iput(inode);
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 361d69f756f5..0e96146ecf69 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -431,7 +431,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
dentry = d_alloc_name(root, "binder-control");
if (!dentry)
- goto out;
+ goto out_with_minor;
inode->i_private = device;
info->control_dentry = dentry;
@@ -440,6 +440,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
return 0;
+out_with_minor:
+ mutex_lock(&binderfs_minors_mutex);
+ ida_free(&binderfs_minors, minor);
+ mutex_unlock(&binderfs_minors_mutex);
+
out:
kfree(device);
iput(inode);
base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86
--
2.25.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v3] binderfs: free minor on binder-control creation failure
2026-08-11 1:05 ` [PATCH v3] " Chao Huang
@ 2026-08-11 2:52 ` Carlos Llamas
0 siblings, 0 replies; 6+ messages in thread
From: Carlos Llamas @ 2026-08-11 2:52 UTC (permalink / raw)
To: Chao Huang
Cc: Alice Ryhl, Greg Kroah-Hartman, Arve Hjønnevåg,
Todd Kjos, Christian Brauner, linux-kernel, Chao Huang
On Tue, Aug 11, 2026 at 09:05:34AM +0800, Chao Huang wrote:
> From: Chao Huang <huangchao@kylinos.cn>
>
> Both binderfs_binder_ctl_create() implementations allocate a minor before
> creating the binder-control dentry. If d_alloc_name() fails, the error path
> frees the device and drops the inode, but leaves the minor allocated in
> binderfs_minors. Repeated failures can therefore exhaust the global minor
> IDA.
>
> Release the minor from a dedicated error path after a successful allocation
> in both implementations.
>
> Signed-off-by: Chao Huang <huangchao@kylinos.cn>
> ---
> Changes in v3:
> - Use a dedicated out_with_minor error path instead of an -ENOSPC sentinel.
>
> drivers/android/binder/rust_binderfs.c | 7 ++++++-
> drivers/android/binderfs.c | 7 ++++++-
> 2 files changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
> index ade1c4d92499..0763e3db54bd 100644
> --- a/drivers/android/binder/rust_binderfs.c
> +++ b/drivers/android/binder/rust_binderfs.c
> @@ -421,7 +421,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>
> dentry = d_alloc_name(root, "binder-control");
> if (!dentry)
> - goto out;
> + goto out_with_minor;
>
> inode->i_private = device;
> info->control_dentry = dentry;
> @@ -430,6 +430,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>
> return 0;
>
> +out_with_minor:
> + mutex_lock(&binderfs_minors_mutex);
> + ida_free(&binderfs_minors, minor);
> + mutex_unlock(&binderfs_minors_mutex);
> +
> out:
> kfree(device);
> iput(inode);
> diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
> index 361d69f756f5..0e96146ecf69 100644
> --- a/drivers/android/binderfs.c
> +++ b/drivers/android/binderfs.c
> @@ -431,7 +431,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>
> dentry = d_alloc_name(root, "binder-control");
> if (!dentry)
> - goto out;
> + goto out_with_minor;
>
> inode->i_private = device;
> info->control_dentry = dentry;
> @@ -440,6 +440,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>
> return 0;
>
> +out_with_minor:
> + mutex_lock(&binderfs_minors_mutex);
> + ida_free(&binderfs_minors, minor);
> + mutex_unlock(&binderfs_minors_mutex);
> +
> out:
> kfree(device);
> iput(inode);
>
> base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86
> --
> 2.25.1
>
LGTM,
Acked-by: Carlos Llamas <cmllamas@google.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-11 2:52 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-06 11:23 [PATCH] binderfs: free minor on binder-control creation failure Chao Huang
2026-08-08 13:34 ` Alice Ryhl
2026-08-10 9:32 ` [PATCH v2] " Chao Huang
2026-08-10 20:16 ` Carlos Llamas
2026-08-11 1:05 ` [PATCH v3] " Chao Huang
2026-08-11 2:52 ` Carlos Llamas
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.