From: Carlos Llamas <cmllamas@google.com>
To: Alice Ryhl <aliceryhl@google.com>
Cc: Dan Carpenter <dan.carpenter@linaro.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
oe-kbuild@lists.linux.dev, lkp@intel.com,
oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org,
Wedson Almeida Filho <wedsonaf@gmail.com>,
Matt Gilbride <mattgilbride@google.com>
Subject: Re: drivers/android/binder/rust_binderfs.c:134 binderfs_binder_device_create() error: Calling ida_alloc_max() with a 'max' argument which is a power of 2. -1 missing?
Date: Tue, 27 Jan 2026 20:48:25 +0000 [thread overview]
Message-ID: <aXkkmSB06Blnk3kf@google.com> (raw)
In-Reply-To: <aUO3ES90gStGvjxn@google.com>
On Thu, Dec 18, 2025 at 08:10:57AM +0000, Alice Ryhl wrote:
> On Thu, Dec 18, 2025 at 10:17:52AM +0300, Dan Carpenter wrote:
> > tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > head: ea1013c1539270e372fc99854bc6e4d94eaeff66
> > commit: eafedbc7c050c44744fbdf80bdf3315e860b7513 rust_binder: add Rust Binder driver
> > config: loongarch-randconfig-r071-20251218 (https://download.01.org/0day-ci/archive/20251218/202512181203.IOv6IChH-lkp@intel.com/config)
> > compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 1335a05ab8bc8339ce24be3a9da89d8c3f4e0571)
> > rustc: rustc 1.88.0 (6b00bc388 2025-06-23)
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp@intel.com>
> > | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> > | Closes: https://lore.kernel.org/r/202512181203.IOv6IChH-lkp@intel.com/
> >
> > smatch warnings:
> > drivers/android/binder/rust_binderfs.c:134 binderfs_binder_device_create() error: Calling ida_alloc_max() with a 'max' argument which is a power of 2. -1 missing?
> > drivers/android/binder/rust_binderfs.c:418 binderfs_binder_ctl_create() error: Calling ida_alloc_max() with a 'max' argument which is a power of 2. -1 missing?
> >
> > vim +/max +134 drivers/android/binder/rust_binderfs.c
> >
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 130
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 131 /* Reserve new minor number for the new device. */
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 132 mutex_lock(&binderfs_minors_mutex);
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 133 if (++info->device_count <= info->mount_opts.max)
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 @134 minor = ida_alloc_max(&binderfs_minors,
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 135 use_reserve ? BINDERFS_MAX_MINOR :
> > eafedbc7c050c4 Alice Ryhl 2025-09-19 136 BINDERFS_MAX_MINOR_CAPPED,
> >
> > ida_alloc_max() takes the maximum valid id not the count. These should
> > be BINDERFS_MAX_MINOR - 1, BINDERFS_MAX_MINOR_CAPPED - 1.
>
> Hmm, this is reported for rust_binderfs.c, but looks like binderfs.c has
> the same code. That means the bug has been there for a long time.
Yeah, this issue is also in C. Although it seems far fetch to reach that
number of binder devices (1 << 20). This still needs to be fixed though
as (1 << 20) overflows the max value for minor and I don't know what
happens then. I'll send out a patch.
--
Carlos Llamas
prev parent reply other threads:[~2026-01-27 20:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-18 7:17 drivers/android/binder/rust_binderfs.c:134 binderfs_binder_device_create() error: Calling ida_alloc_max() with a 'max' argument which is a power of 2. -1 missing? Dan Carpenter
2025-12-18 8:10 ` Alice Ryhl
2026-01-27 20:48 ` Carlos Llamas [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXkkmSB06Blnk3kf@google.com \
--to=cmllamas@google.com \
--cc=aliceryhl@google.com \
--cc=dan.carpenter@linaro.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=mattgilbride@google.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=wedsonaf@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox