From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C877A37CD5A for ; Mon, 10 Aug 2026 20:16:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786393018; cv=none; b=HyGMjPJazylRJDT+mX2vSrtdKMVj0xfr1qSKvhDZKJ4Xl3JZRxw0ONGGMmpj6WWBtF4RL09NA+sAiaueKR/UqJf1Sfc1nKbu6W64eBUSfd/os1bUWlybPWYsO/ZgRKt1+jtEvNfIb2mH4mw6+qJcCxw/LIR2mtC5fkXvzJZ/UNo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786393018; c=relaxed/simple; bh=pqTuS5c+bKj63tAq75BSmvSrDBDGPudaY41pMq4r5Dg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ctSXXbHXBbgImW2y+0Evx91Sj3eVgxIuoxkojDCZ4j5lxRxwnfkIpYLV0WLXBueNv0Ld+/7AEHWWciWG+EfFaUKChmWuQeQMeRuRqqSsZTSU91vxhI21WON3rmCQb+ap5KdALfkegR+4zzsqalKmy+ShgumjyzPYr0Fbochpmn4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=syDdVQnc; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="syDdVQnc" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2cacef7d299so3825ad.1 for ; Mon, 10 Aug 2026 13:16:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786393016; x=1786997816; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=S0dgpmEFBW9wbWMPancFbwVhe6UlsA2PVkbeWMzZPYI=; b=syDdVQncuPOfUE8zu28wIFycUpjZ0LDEXN67X0IiZJsEgLruvBwFiemwG9VvtP5n8a 1btA+ErirkRFPl4zyYRexBekTmh7NLCTOfBHIgTBrPFvsdyQPMo2Nkv601o3CdD8U0SM AtXqEVFyHrHmGxVAacWw1kOw/erOnCLfcNJnA1y5WfM5t/A9+o9Pwcsbx3DbnUIQ9ebM xIbYYN6i1iAGemYexBVbb2V6yeyj9ajlOMjz7Tp5Rv5d591EoefEhrHB/TNERFhm+XrN u0T70zXar0V5uWjwPA6jISKBb1R/RsepHYa9T3B1OPHgeaWo8WaBTxZhOHqmFJMWrUrC IWXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786393016; x=1786997816; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=S0dgpmEFBW9wbWMPancFbwVhe6UlsA2PVkbeWMzZPYI=; b=dMAgYck+M9mVI+JuUSmOc+tmyKhPYdNxQoknCtVUJG34ZefVwj2rtwSsJG8biwG1Mb QHzxztkmJQEA85Z2/DdBSmih7APrAcP6SjTrhfv7yYpVGz4WXT4y7xv/73PL/K3D4JNg ps/T8kZo0r7zolrlDGBFssjL+O1hXUQB5wp/U+Bm48fQC1wJbr8uZ4uR1L2OkFGJvh6M nLxDomnul0FMlA6eTEJBgmZ3skWbRu8xBBOChRTNYYHh+lRKgVm3CpoBmj9OChfsfbBS N3Jcu7czpYDn6v7pdPpIQjEfvk+gck5FE0e7RMkOPgTpm4StAHOvlUBxPiKX4wJCiSq5 dAkw== X-Forwarded-Encrypted: i=1; AHgh+RqfEc9L0ZubZajzTDuX5PDGmfLUadTYenNLV6O2i9BxleJiGsdz/3TLEyM9FXzeb5sxqkeBQRWMQULS1fE=@vger.kernel.org X-Gm-Message-State: AOJu0YwYXXrDEISSMO99n740iZdtKtWqq9i5HY7z5b5X2PxXaANlTR7y RlUXrnGTWyCnFJIWnspTjIDhtnGmlddzLYkTcI+llkZpRGUY0pruscOkXZlWL47zOvf4WOT2eVi 0DlYJWg== X-Gm-Gg: AR+sD10H7nYJssPhIGHpm66F7e+CxS6Gu9rGJAfzixrywI6ejMG8Y9+3D/I01PiUld7 1ImhM4E9KxyQPnoI69vHywNlmuhWQ+bVdYe77SpKeTnhHkI2Ey1nNA4yuG3Ekp5a43DK3WEG0Fc WNon4Dbr2dkNfSXpg2+59hL1cHhqAKjz2SQbvEVi6S7cD6IWwHNB5Adeluyzcbu0kn+T8IzSgC5 8BAqQOw4qSK+LLZPSiWbpILMxlHZRUaHkqhj0Klfp2TWELsVdvDnSeBlWuxDtEGKxmAXpZdxcD7 qMzgFXeyUavIH2qIQsW7ejTHgzawAWFXTK9uk3brtyLLHMKsinLdNqyKq3llTXUi3QOR5vEoXV1 luuPJ7g/S+SvJu7Ye4QU6C1BNs0kLmR9miW8+fb+P+ATcGzIN47GEdRF0sEpfVTFXg0prp+rTf3 fI2WkZikcuE3yyS1uFtlUuFJiaE5BUXp0AORsDIdpQk9usfg8Va4+lXfBBBeq+gUs5kE9kq7Saj 6gaYVFMrc6bKvj2BUPloB2t1BgxGvUAypbZxsNud5eEtJziQ6l49is5V4DJzOPN3DDNzaB7693H VlKvbu0= X-Received: by 2002:a17:902:f0cc:b0:2c7:9e6a:1a8d with SMTP id d9443c01a7336-2d3106ee29cmr1735455ad.12.1786393015401; Mon, 10 Aug 2026 13:16:55 -0700 (PDT) Received: from google.com (193.67.125.34.bc.googleusercontent.com. [34.125.67.193]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d14dbea7e0sm40452465ad.53.2026.08.10.13.16.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 13:16:54 -0700 (PDT) Date: Mon, 10 Aug 2026 20:16:50 +0000 From: Carlos Llamas To: Chao Huang <958028483@qq.com> Cc: Alice Ryhl , Greg Kroah-Hartman , Arve =?iso-8859-1?B?SGr4bm5lduVn?= , Todd Kjos , Christian Brauner , linux-kernel@vger.kernel.org, Chao Huang Subject: Re: [PATCH v2] binderfs: free minor on binder-control creation failure Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Mon, Aug 10, 2026 at 05:32:16PM +0800, Chao Huang wrote: > From: Chao Huang > > Both binderfs_binder_ctl_create() implementations allocate a minor before > creating the binder-control dentry. If d_alloc_name() fails, the error path > frees the device and drops the inode, but leaves the minor allocated in > binderfs_minors. Repeated failures can therefore exhaust the global minor > IDA. > > Initialize minor to an invalid value and release it from the common error > path after a successful allocation in both implementations. > > Signed-off-by: Chao Huang > --- > Changes in v2: > - Apply the same fix to drivers/android/binder/rust_binderfs.c. > > drivers/android/binder/rust_binderfs.c | 7 ++++++- > drivers/android/binderfs.c | 7 ++++++- > 2 files changed, 12 insertions(+), 2 deletions(-) > > diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c > index ade1c4d92499..c65a8e514986 100644 > --- a/drivers/android/binder/rust_binderfs.c > +++ b/drivers/android/binder/rust_binderfs.c > @@ -375,7 +375,7 @@ static const struct file_operations binder_ctl_fops = { > */ > static int binderfs_binder_ctl_create(struct super_block *sb) > { > - int minor, ret; > + int minor = -ENOSPC, ret; > struct dentry *dentry; > struct binder_device *device; > struct inode *inode = NULL; > @@ -431,6 +431,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb) > return 0; > > out: > + if (minor >= 0) { > + mutex_lock(&binderfs_minors_mutex); > + ida_free(&binderfs_minors, minor); > + mutex_unlock(&binderfs_minors_mutex); > + } > kfree(device); > iput(inode); > > diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c > index 361d69f756f5..fdbf281d3418 100644 > --- a/drivers/android/binderfs.c > +++ b/drivers/android/binderfs.c > @@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops = { > */ > static int binderfs_binder_ctl_create(struct super_block *sb) > { > - int minor, ret; > + int minor = -ENOSPC, ret; Why -ENOSPC? > struct dentry *dentry; > struct binder_device *device; > struct inode *inode = NULL; > @@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb) > return 0; > > out: > + if (minor >= 0) { > + mutex_lock(&binderfs_minors_mutex); > + ida_free(&binderfs_minors, minor); > + mutex_unlock(&binderfs_minors_mutex); > + } How about a new "goto out_with_minor;" tag? This removes the odd ENOSPC value and having to do this if (minor) check. > kfree(device); > iput(inode); > > > base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86 > -- > 2.25.1 >