kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/android
History
Carlos Llamas ee5e42e9a5 binderfs: fix ida_alloc_max() upper bound 
commit ec4ddc90d2 upstream.

The 'max' argument of ida_alloc_max() takes the maximum valid ID and not
the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor
would exceed the limits of minor numbers (20-bits). Fix this off-by-one
error by subtracting 1 from the 'max'.

Cc: stable@vger.kernel.org
Fixes: 3ad20fe393 ("binder: implement binderfs")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260127235545.2307876-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-02-11 13:40:18 +01:00
..
binder.c binder: fix BR_FROZEN_REPLY error log 2026-02-11 13:40:18 +01:00
binder_alloc.c binder_alloc: Fix sleeping function called from invalid context 2024-07-31 13:48:25 +02:00
binder_alloc.h binder: switch alloc->mutex to spinlock_t 2023-12-05 09:23:41 +09:00
binder_alloc_selftest.c android: binder: fix a kernel-doc enum warning 2023-12-06 08:48:26 +09:00
binder_internal.h binder: frozen notification 2024-07-31 13:56:00 +02:00
binder_trace.h binder: keep vma addresses type as unsigned long 2023-12-05 09:23:38 +09:00
binderfs.c binderfs: fix ida_alloc_max() upper bound 2026-02-11 13:40:18 +01:00
dbitmap.h binder: fix double-free in dbitmap 2025-10-12 12:57:18 +02:00
Kconfig remove CONFIG_ANDROID 2022-07-01 10:41:09 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00