287221c5e0
commit d6ba734814266bbf7ee01f9030436597116805f3 upstream.
The 'max' argument of ida_alloc_max() takes the maximum valid ID and not
the "count". Using an ID of BINDERFS_MAX_MINOR (1 << 20) for dev->minor
would exceed the limits of minor numbers (20-bits). Fix this off-by-one
error by subtracting 1 from the 'max'.
Cc: stable@vger.kernel.org
Fixes:
|
||
|---|---|---|
| .. | ||
| node | ||
| range_alloc | ||
| Makefile | ||
| allocation.rs | ||
| context.rs | ||
| deferred_close.rs | ||
| defs.rs | ||
| error.rs | ||
| freeze.rs | ||
| node.rs | ||
| page_range.rs | ||
| page_range_helper.c | ||
| page_range_helper.h | ||
| process.rs | ||
| rust_binder.h | ||
| rust_binder_events.c | ||
| rust_binder_events.h | ||
| rust_binder_internal.h | ||
| rust_binder_main.rs | ||
| rust_binderfs.c | ||
| stats.rs | ||
| thread.rs | ||
| trace.rs | ||
| transaction.rs | ||