Re: [PATCH] binder: restrict BINDER_NLGRP_REPORT to CAP_NET_ADMIN and fix binderfs minor leak

[Greg KH]

On Sat, Sep 19, 2026 at 09:36:54PM +0000, Hui Peng wrote:
> Fix three security and resource-accounting issues in `binder_netlink.c`
> and `binderfs.c`:
> 
> 1. In `drivers/android/binder_netlink.c`,
>    `binder_nl_mcgrps[BINDER_NLGRP_REPORT]` is declared without `.flags =
>    GENL_MCAST_CAP_NET_ADMIN`, allowing any unprivileged local user to
>    subscribe to the `BINDER_NLGRP_REPORT` Generic Netlink multicast
>    group and monitor system-wide binder transaction error reports
>    (including sender/target PIDs and transaction metadata).
> 2. In `drivers/android/binderfs.c`, `binderfs_binder_ctl_create()`
>    allocates an IDA minor via `ida_alloc_max(&binderfs_minors, ...)`,
>    and if `d_alloc_name(root, "binder-control")` fails, jumps to `out:`
>    (which calls `kfree(device)`) without freeing `minor` from
>    `binderfs_minors`.
> 3. When the `binder-control` inode (`device->context.name == NULL`) is
>    evicted in `binderfs_evict_inode()`, `--info->device_count` is
>    decremented even though `binderfs_binder_ctl_create()` never
>    incremented `info->device_count`, underflowing `info->device_count`.
>    Only decrement `info->device_count` when `device->context.name` is
>    non-NULL.

Why isn't this 3 different patches?

thanks,

greg kh