kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/android
History
Carlos Llamas 9a6cdfd7b6 binderfs: fix ida_alloc_max() upper bound 
commit ec4ddc90d2 upstream.

The 'max' argument of ida_alloc_max() takes the maximum valid ID and not
the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor
would exceed the limits of minor numbers (20-bits). Fix this off-by-one
error by subtracting 1 from the 'max'.

Cc: stable@vger.kernel.org
Fixes: 3ad20fe393 ("binder: implement binderfs")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260127235545.2307876-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-11 13:35:29 +01:00
..
binder.c binder: remove "invalid inc weak" check 2025-10-29 14:03:12 +01:00
binder_alloc.c binder: fix race between mmput() and do_exit() 2024-01-25 14:52:46 -08:00
binder_alloc.h binder: fix memory leak in binder_init() 2023-08-16 18:21:59 +02:00
binder_alloc_selftest.c Revert "android: binder: stop saving a pointer to the VMA" 2023-06-05 09:21:24 +02:00
binder_internal.h binder: fix max_thread type inconsistency 2024-05-25 16:20:18 +02:00
binder_trace.h binder: add trace at free transaction. 2020-11-11 08:20:44 +01:00
binderfs.c binderfs: fix ida_alloc_max() upper bound 2026-02-11 13:35:29 +01:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00