Re: [PATCH] rust_binderfs: fix minor number leak on binder-control creation failure

[Carlos Llamas]

On Mon, Nov 02, 2026 at 08:15:32PM +0530, Adhyansh Verma wrote:
> In binderfs_binder_ctl_create(), a minor number is reserved using
> ida_alloc_max(). If d_alloc_name() subsequently fails (e.g. under memory
> pressure), the function jumps to the error path.
> 
> However, the cleanup path only calls kfree(device) and iput(inode).
> Because inode->i_private has not yet been set to device, the eviction
> handler binderfs_evict_inode() returns early without freeing the minor
> number. Consequently, the reserved minor number is permanently leaked
> from the global binderfs_minors IDA.
> 
> Fix this by introducing proper error unwind labels so that the allocated
> minor number is released via ida_free() under binderfs_minors_mutex if
> dentry allocation fails.
> 
> Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> Signed-off-by: Adhyansh Verma <adhyanshverma2010@xxxxxxxxx>
> ---
>  drivers/android/binder/rust_binderfs.c | 15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
> index 5f020226720d..3f7ff0fdbdb9 100644
> --- a/drivers/android/binder/rust_binderfs.c
> +++ b/drivers/android/binder/rust_binderfs.c
> @@ -400,7 +400,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>  	ret = -ENOMEM;
>  	inode = new_inode(sb);
>  	if (!inode)
> -		goto out;
> +		goto out_device;
>  
>  	/* Reserve a new minor number for the new device. */
>  	mutex_lock(&binderfs_minors_mutex);
> @@ -411,7 +411,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>  	mutex_unlock(&binderfs_minors_mutex);
>  	if (minor < 0) {
>  		ret = minor;
> -		goto out;
> +		goto out_inode;
>  	}
>  
>  	inode->i_ino = SECOND_INODE;
> @@ -427,7 +427,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>  
>  	dentry = d_alloc_name(root, "binder-control");
>  	if (!dentry)
> -		goto out;
> +		goto out_minor;
>  
>  	inode->i_private = device;
>  	info->control_dentry = dentry;
> @@ -436,9 +436,14 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
>  
>  	return 0;
>  
> -out:
> -	kfree(device);
> +out_minor:
> +	mutex_lock(&binderfs_minors_mutex);
> +	ida_free(&binderfs_minors, minor);
> +	mutex_unlock(&binderfs_minors_mutex);
> +out_inode:
>  	iput(inode);
> +out_device:
> +	kfree(device);
>  
>  	return ret;
>  }
> -- 
> 2.56.0
> 

Is this patch any different from this one? :
https://lore.kernel.org/all/tencent_8D7B76C623DA3A29EE73D38217ACB08AFB09@xxxxxx/