archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 04:44:45 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/drivers/android
History
Carlos Llamas ec4ddc90d2 binderfs: fix ida_alloc_max() upper bound 
The 'max' argument of ida_alloc_max() takes the maximum valid ID and not
the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor
would exceed the limits of minor numbers (20-bits). Fix this off-by-one
error by subtracting 1 from the 'max'.

Cc: stable@vger.kernel.org
Fixes: 3ad20fe393 ("binder: implement binderfs")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260127235545.2307876-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-02-03 12:59:07 +01:00
..
binder rust_binderfs: fix ida_alloc_max() upper bound 2026-02-03 12:59:06 +01:00
tests binder: mark binder_alloc_exhaustive_test as slow 2025-11-26 13:24:19 +01:00
binder.c binder: fix BR_FROZEN_REPLY error log 2026-01-26 16:30:07 +01:00
binder_alloc.c binder: Convert binder_alloc selftests to KUnit 2025-07-16 14:11:59 +02:00
binder_alloc.h binder: Convert binder_alloc selftests to KUnit 2025-07-16 14:11:59 +02:00
binder_internal.h binder: add t->is_async and t->is_reply 2025-08-19 12:53:01 +02:00
binder_netlink.c tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
binder_netlink.h tools: ynl-gen: add regeneration comment 2025-11-25 19:20:42 -08:00
binder_trace.h binder: add tracepoint for netlink reports 2025-08-19 12:53:02 +02:00
binderfs.c binderfs: fix ida_alloc_max() upper bound 2026-02-03 12:59:07 +01:00
dbitmap.h binder: fix double-free in dbitmap 2025-09-18 17:20:00 +02:00
Kconfig rust_binder: add Rust Binder driver 2025-09-19 09:40:46 +02:00
Makefile rust_binder: add Rust Binder driver 2025-09-19 09:40:46 +02:00