[PATCH] binderfs: free minor on binder-control creation failure

[Chao Huang]

From: Chao Huang <huangchao@xxxxxxxxxx>

binderfs_binder_ctl_create() allocates a minor before creating the
binder-control dentry. If d_alloc_name() fails, the error path frees the
device and drops the inode, but leaves the minor allocated in
binderfs_minors. Repeated failures can therefore exhaust the global minor
IDA.

Initialize minor to an invalid value and release it from the common error
path after a successful allocation.

Signed-off-by: Chao Huang <huangchao@xxxxxxxxxx>
---
 drivers/android/binderfs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
index 361d69f756f5..fdbf281d3418 100644
--- a/drivers/android/binderfs.c
+++ b/drivers/android/binderfs.c
@@ -384,7 +384,7 @@ static const struct file_operations binder_ctl_fops = {
  */
 static int binderfs_binder_ctl_create(struct super_block *sb)
 {
-	int minor, ret;
+	int minor = -ENOSPC, ret;
 	struct dentry *dentry;
 	struct binder_device *device;
 	struct inode *inode = NULL;
@@ -441,6 +441,11 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
 	return 0;
 
 out:
+	if (minor >= 0) {
+		mutex_lock(&binderfs_minors_mutex);
+		ida_free(&binderfs_minors, minor);
+		mutex_unlock(&binderfs_minors_mutex);
+	}
 	kfree(device);
 	iput(inode);
 

base-commit: c21bb4193868a8de71fc4693fa741e195fdf5d86
-- 
2.25.1