Re: [PATCH 2/2] binder: fix is_failure flag for superseded transaction cleanup

[Carlos Llamas <cmllamas@google.com>]

On Wed, Aug 12, 2026 at 10:53:16PM +0300, Tomer Pomeranc wrote:
> When a TF_UPDATE_TXN transaction supersedes a pending async transaction,
> binder_release_entire_buffer() is called with is_failure=false. Since the
> superseded transaction was never delivered, binder_apply_fd_fixups() was
> never called and no fds were installed in the target process.
> 
> With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets
> stale buffer contents as installed fd numbers and passes them to
> binder_deferred_fd_close(), closing unrelated file descriptors.
> 
> Pass is_failure=true since the transaction was never delivered to the
> target, matching the semantics of all other undelivered-transaction
> cleanup paths.
> 
> Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tomer Pomeranc <tomerpo@gmail.com>
> ---
>  drivers/android/binder.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index f70aeb63a..bc8bc9ee4 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2930,7 +2930,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
>  		t_outdated->buffer = NULL;
>  		buffer->transaction = NULL;
>  		trace_binder_transaction_update_buffer_release(buffer);
> -		binder_release_entire_buffer(proc, NULL, buffer, false);
> +		binder_release_entire_buffer(proc, NULL, buffer, true);
>  		binder_alloc_free_buf(&proc->alloc, buffer);
>  		binder_free_txn_fixups(t_outdated);
>  		kfree(t_outdated);
> -- 
> 2.34.1
> 

Thanks,
Acked-by: Carlos Llamas <cmllamas@google.com>