On Sun, Dec 23, 2018 at 03:35:49PM +0100, Christian Brauner wrote:
> static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
> @@ -110,10 +132,16 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
>
> /* Reserve new minor number for the new device. */
> mutex_lock(&binderfs_minors_mutex);
> - minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
> + if (++info->device_count <= info->mount_opts.max)
> + minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR,
> + GFP_KERNEL);
> + else
> + minor = -ENOSPC;
> mutex_unlock(&binderfs_minors_mutex);
> - if (minor < 0)
> + if (minor < 0) {
> + --info->device_count;
Isn't this decrement supposed to happen under binderfs_minors_mutex?
> return minor;
> + }
regards,
dan carpenter
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
