On Wed, Jan 02, 2019 at 12:17:31PM +0300, Dan Carpenter wrote:
> On Sun, Dec 23, 2018 at 03:35:49PM +0100, Christian Brauner wrote:
> > static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
> > @@ -110,10 +132,16 @@ static int binderfs_binder_device_create(struct inode *ref_inode,
> >
> > /* Reserve new minor number for the new device. */
> > mutex_lock(&binderfs_minors_mutex);
> > - minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
> > + if (++info->device_count <= info->mount_opts.max)
> > + minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR,
> > + GFP_KERNEL);
> > + else
> > + minor = -ENOSPC;
> > mutex_unlock(&binderfs_minors_mutex);
> > - if (minor < 0)
> > + if (minor < 0) {
> > + --info->device_count;
>
> Isn't this decrement supposed to happen under binderfs_minors_mutex?
Indeed. Good catch!
Leftover from when this was an atomic_t.
Thanks!
Christian
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
