[PATCH 0/2] binder: fix TF_UPDATE_TXN supersede cleanup bugs

[PATCH 0/2] binder: fix TF_UPDATE_TXN supersede cleanup bugs

[Tomer Pomeranc]

Two bugs in the t_outdated cleanup path of binder_proc_transaction(),
both introduced by commit 9864bb480133 ("binder: add TF_UPDATE_TXN to
replace outdated txn"):

1. kfree(t_outdated) is called without binder_free_txn_fixups(),
   permanently leaking binder_txn_fd_fixup entries and their fget()'d
   struct file references. The refcount never reaches zero; the leak
   survives process exit and accumulates until file-max exhaustion.

2. binder_release_entire_buffer() is called with is_failure=false for
   a transaction that was never delivered. Since binder_apply_fd_fixups()
   was never called, the BINDER_TYPE_FDA handler reads stale buffer data
   as fd numbers and closes unrelated fds via binder_deferred_fd_close().

Confirmed on mainline Linux (6.8.0-124-generic, binder_linux module)
and Android (Pixel 8, kernel 6.1.124, /dev/hwbinder).

Tomer Pomeranc (2):
  binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
  binder: fix is_failure flag for superseded transaction cleanup

 drivers/android/binder.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

-- 
2.34.1

[PATCH 1/2] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

[Tomer Pomeranc]

When a TF_UPDATE_TXN transaction supersedes a pending async transaction
in a frozen process, the outdated transaction is freed with kfree()
directly. This skips binder_free_txn_fixups(), leaking all
binder_txn_fd_fixup entries and their fget()'d struct file references.

The leaked file refcounts never reach zero, so the struct file objects
are permanently pinned in memory. They survive process exit and
accumulate across invocations until file-max exhaustion.

Every other transaction cleanup path (binder_free_transaction(),
binder_transaction() error paths, binder_release_work()) correctly
calls binder_free_txn_fixups(). Add the missing call before kfree()
in the t_outdated cleanup block.

Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn")
Cc: stable@vger.kernel.org
Signed-off-by: Tomer Pomeranc <tomerpo@gmail.com>
---
 drivers/android/binder.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 8f2ef1bd5..f70aeb63a 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2932,6 +2932,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
 		trace_binder_transaction_update_buffer_release(buffer);
 		binder_release_entire_buffer(proc, NULL, buffer, false);
 		binder_alloc_free_buf(&proc->alloc, buffer);
+		binder_free_txn_fixups(t_outdated);
 		kfree(t_outdated);
 		binder_stats_deleted(BINDER_STAT_TRANSACTION);
 	}
-- 
2.34.1

Re: [PATCH 1/2] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

[Carlos Llamas]

On Wed, Aug 12, 2026 at 10:53:15PM +0300, Tomer Pomeranc wrote:
> When a TF_UPDATE_TXN transaction supersedes a pending async transaction
> in a frozen process, the outdated transaction is freed with kfree()
> directly. This skips binder_free_txn_fixups(), leaking all
> binder_txn_fd_fixup entries and their fget()'d struct file references.
> 
> The leaked file refcounts never reach zero, so the struct file objects
> are permanently pinned in memory. They survive process exit and
> accumulate across invocations until file-max exhaustion.
> 
> Every other transaction cleanup path (binder_free_transaction(),
> binder_transaction() error paths, binder_release_work()) correctly
> calls binder_free_txn_fixups(). Add the missing call before kfree()
> in the t_outdated cleanup block.
> 
> Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tomer Pomeranc <tomerpo@gmail.com>
> ---
>  drivers/android/binder.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 8f2ef1bd5..f70aeb63a 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2932,6 +2932,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
>  		trace_binder_transaction_update_buffer_release(buffer);
>  		binder_release_entire_buffer(proc, NULL, buffer, false);
>  		binder_alloc_free_buf(&proc->alloc, buffer);
> +		binder_free_txn_fixups(t_outdated);
>  		kfree(t_outdated);
>  		binder_stats_deleted(BINDER_STAT_TRANSACTION);
>  	}
> -- 
> 2.34.1
> 

Thanks,
Acked-by: Carlos Llamas <cmllamas@google.com>

[PATCH 2/2] binder: fix is_failure flag for superseded transaction cleanup

[Tomer Pomeranc]

When a TF_UPDATE_TXN transaction supersedes a pending async transaction,
binder_release_entire_buffer() is called with is_failure=false. Since the
superseded transaction was never delivered, binder_apply_fd_fixups() was
never called and no fds were installed in the target process.

With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets
stale buffer contents as installed fd numbers and passes them to
binder_deferred_fd_close(), closing unrelated file descriptors.

Pass is_failure=true since the transaction was never delivered to the
target, matching the semantics of all other undelivered-transaction
cleanup paths.

Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn")
Cc: stable@vger.kernel.org
Signed-off-by: Tomer Pomeranc <tomerpo@gmail.com>
---
 drivers/android/binder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index f70aeb63a..bc8bc9ee4 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2930,7 +2930,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
 		t_outdated->buffer = NULL;
 		buffer->transaction = NULL;
 		trace_binder_transaction_update_buffer_release(buffer);
-		binder_release_entire_buffer(proc, NULL, buffer, false);
+		binder_release_entire_buffer(proc, NULL, buffer, true);
 		binder_alloc_free_buf(&proc->alloc, buffer);
 		binder_free_txn_fixups(t_outdated);
 		kfree(t_outdated);
-- 
2.34.1

Re: [PATCH 2/2] binder: fix is_failure flag for superseded transaction cleanup

[Carlos Llamas]

On Wed, Aug 12, 2026 at 10:53:16PM +0300, Tomer Pomeranc wrote:
> When a TF_UPDATE_TXN transaction supersedes a pending async transaction,
> binder_release_entire_buffer() is called with is_failure=false. Since the
> superseded transaction was never delivered, binder_apply_fd_fixups() was
> never called and no fds were installed in the target process.
> 
> With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets
> stale buffer contents as installed fd numbers and passes them to
> binder_deferred_fd_close(), closing unrelated file descriptors.
> 
> Pass is_failure=true since the transaction was never delivered to the
> target, matching the semantics of all other undelivered-transaction
> cleanup paths.
> 
> Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tomer Pomeranc <tomerpo@gmail.com>
> ---
>  drivers/android/binder.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index f70aeb63a..bc8bc9ee4 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2930,7 +2930,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
>  		t_outdated->buffer = NULL;
>  		buffer->transaction = NULL;
>  		trace_binder_transaction_update_buffer_release(buffer);
> -		binder_release_entire_buffer(proc, NULL, buffer, false);
> +		binder_release_entire_buffer(proc, NULL, buffer, true);
>  		binder_alloc_free_buf(&proc->alloc, buffer);
>  		binder_free_txn_fixups(t_outdated);
>  		kfree(t_outdated);
> -- 
> 2.34.1
> 

Thanks,
Acked-by: Carlos Llamas <cmllamas@google.com>

Re: [PATCH 0/2] binder: fix TF_UPDATE_TXN supersede cleanup bugs

[Carlos Llamas]

On Wed, Aug 12, 2026 at 10:53:14PM +0300, Tomer Pomeranc wrote:
> Two bugs in the t_outdated cleanup path of binder_proc_transaction(),
> both introduced by commit 9864bb480133 ("binder: add TF_UPDATE_TXN to
> replace outdated txn"):

I was never a fan of this TF_UPDATE_TXN flag. This is a kernel band-aid
patch for a flow-control problem in userspace.

> 
> 1. kfree(t_outdated) is called without binder_free_txn_fixups(),
>    permanently leaking binder_txn_fd_fixup entries and their fget()'d
>    struct file references. The refcount never reaches zero; the leak
>    survives process exit and accumulates until file-max exhaustion.

Yes.

> 
> 2. binder_release_entire_buffer() is called with is_failure=false for
>    a transaction that was never delivered. Since binder_apply_fd_fixups()
>    was never called, the BINDER_TYPE_FDA handler reads stale buffer data
>    as fd numbers and closes unrelated fds via binder_deferred_fd_close().

Ha! good catch.

> 
> Confirmed on mainline Linux (6.8.0-124-generic, binder_linux module)
> and Android (Pixel 8, kernel 6.1.124, /dev/hwbinder).
> 
> Tomer Pomeranc (2):
>   binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
>   binder: fix is_failure flag for superseded transaction cleanup
> 
>  drivers/android/binder.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> -- 
> 2.34.1
> 

So both fixes LGTM, and we should take them.

However, I'm thinking we should drop this code. We now have frozen
process notifications and that should prevent duplicate transactions to
frozen processes from happening in the first place. So we remove the
code and mark TF_UPDATE_TXN as obsolete.

... or maybe we just drop the entire C binder code base. I'm tired of
all these memory issues.

--
Carlos Llamas