[PATCH/report] binderfs: minor leaked in binderfs_binder_ctl_create() error path

[kerhunt]

Hi Greg, Todd,

binderfs_binder_ctl_create() (drivers/android/binderfs.c) leaks
the allocated minor if d_alloc_name() fails after the
ida_alloc_max() call: the error path frees the device and puts
the inode but never calls ida_free() on binderfs_minors, so the
minor is permanently lost from the global pool. The success path
releases it correctly via evict_inode() (binderfs.c:259-277).

Fix: ida_free(&binderfs_minors, minor) in the error path (or
restructure so the minor is freed on all failure exits after
allocation).

Confirmed on linux-6.12.112 (7aba70ab) and mainline HEAD.
Happy to send the formal patch. Please credit "kerhunt
<kerhunt@xxxxxxxxx>".

Best regards,
kerhunt