diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-02-07 09:27:57 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-02-07 09:27:57 -0800 |
| commit | b0e7d3f88e563b5ca793fca23c7d7fa1352c1079 (patch) | |
| tree | 3359d75a0233c5595182b6f953066ba65a8297ec /drivers/android/binder/rust_binderfs.c | |
| parent | dda5df9823630a26ed24ca9150b33a7f56ba4546 (diff) | |
| parent | ec4ddc90d201d09ef4e4bef8a2c6d9624525ad68 (diff) | |
| download | linux-next-b0e7d3f88e563b5ca793fca23c7d7fa1352c1079.tar.gz linux-next-b0e7d3f88e563b5ca793fca23c7d7fa1352c1079.zip | |
Merge tag 'char-misc-6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull binder fixes from Greg KH:
"Here are some small, last-minute binder C and Rust driver fixes for
reported issues. They include a number of fixes for reported crashes
and other problems.
All of these have been in linux-next this week, and longer"
* tag 'char-misc-6.19-final' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
binderfs: fix ida_alloc_max() upper bound
rust_binderfs: fix ida_alloc_max() upper bound
binder: fix BR_FROZEN_REPLY error log
rust_binder: add additional alignment checks
binder: fix UAF in binder_netlink_report()
rust_binder: correctly handle FDA objects of length zero
Diffstat (limited to 'drivers/android/binder/rust_binderfs.c')
| -rw-r--r-- | drivers/android/binder/rust_binderfs.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c index e36011e89116..5c1319d80036 100644 --- a/drivers/android/binder/rust_binderfs.c +++ b/drivers/android/binder/rust_binderfs.c @@ -132,8 +132,8 @@ static int binderfs_binder_device_create(struct inode *ref_inode, mutex_lock(&binderfs_minors_mutex); if (++info->device_count <= info->mount_opts.max) minor = ida_alloc_max(&binderfs_minors, - use_reserve ? BINDERFS_MAX_MINOR : - BINDERFS_MAX_MINOR_CAPPED, + use_reserve ? BINDERFS_MAX_MINOR - 1 : + BINDERFS_MAX_MINOR_CAPPED - 1, GFP_KERNEL); else minor = -ENOSPC; @@ -399,8 +399,8 @@ static int binderfs_binder_ctl_create(struct super_block *sb) /* Reserve a new minor number for the new device. */ mutex_lock(&binderfs_minors_mutex); minor = ida_alloc_max(&binderfs_minors, - use_reserve ? BINDERFS_MAX_MINOR : - BINDERFS_MAX_MINOR_CAPPED, + use_reserve ? BINDERFS_MAX_MINOR - 1 : + BINDERFS_MAX_MINOR_CAPPED - 1, GFP_KERNEL); mutex_unlock(&binderfs_minors_mutex); if (minor < 0) { |