Carlos Llamas ee5e42e9a5 binderfs: fix ida_alloc_max() upper bound ...

commit ec4ddc90d2 upstream.

The 'max' argument of ida_alloc_max() takes the maximum valid ID and not
the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor
would exceed the limits of minor numbers (20-bits). Fix this off-by-one
error by subtracting 1 from the 'max'.

Cc: stable@vger.kernel.org
Fixes: 3ad20fe393 ("binder: implement binderfs")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260127235545.2307876-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-02-11 13:40:18 +01:00

..

binder_alloc_selftest.c

…

binder_alloc.c

…

binder_alloc.h

…

binder_internal.h

…

binder_trace.h

…

binder.c

binder: fix BR_FROZEN_REPLY error log

2026-02-11 13:40:18 +01:00

binderfs.c

binderfs: fix ida_alloc_max() upper bound

2026-02-11 13:40:18 +01:00

dbitmap.h

…

Kconfig

…

Makefile

…