On Wed, Jan 02, 2019 at 12:17:31PM +0300, Dan Carpenter wrote:
> On Sun, Dec 23, 2018 at 03:35:49PM +0100, Christian Brauner wrote:
> >  static inline struct binderfs_info *BINDERFS_I(const struct inode *inode)
> > @@ -110,10 +132,16 @@ static int binderfs_binder_device_create(struct inode 
> > *ref_inode,
> >  
> >     /* Reserve new minor number for the new device. */
> >     mutex_lock(&binderfs_minors_mutex);
> > -   minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR, GFP_KERNEL);
> > +   if (++info->device_count <= info->mount_opts.max)
> > +           minor = ida_alloc_max(&binderfs_minors, BINDERFS_MAX_MINOR,
> > +                                 GFP_KERNEL);
> > +   else
> > +           minor = -ENOSPC;
> >     mutex_unlock(&binderfs_minors_mutex);
> > -   if (minor < 0)
> > +   if (minor < 0) {
> > +           --info->device_count;
> 
> Isn't this decrement supposed to happen under binderfs_minors_mutex?

Indeed. Good catch!
Leftover from when this was an atomic_t.

Thanks!
Christian
_______________________________________________
devel mailing list
de...@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

Reply via email to