From nobody Tue Sep 29 04:10:17 2026 Received: from mail-wm1-f45.google.com (mail-wm1-f45.google.com [209.85.128.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B0AD38F620 for ; Wed, 12 Aug 2026 19:53:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786564403; cv=none; b=TTASYE63DbZQVlww7+G/GKNI9nsoy4WGjA3ML1aNzWhV4DweqH+FEBfoTqXVtuHyEvZT18XUcGXUldY2f6HklpPP2qPBa3HFtrU/s5KDBgeh/aNOLKC0ktl4B2EYZR8D82T+6067WYKstrUYAhXZwrQRIANXeRP0bDrv1itcQHw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786564403; c=relaxed/simple; bh=ZaZ4wC0gUMSxoDfAoffb9xTcxt5C/x/3HPNvtmy+xz4=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kqFe71JgaC+RuScXLtCos+Yz6WKmq12REfFE/h9JBYYM2Ev7/giwUdm1H1y0j62zCv3m4usvUH1Zf7bHlvAdDjvw6jrer2soSeWcPS54D6VLdHM890oeRarDSm1m0flj8I4tmbFNHo9yu9VoBUeK7d4mlRiXUCymP4pXOysA8aM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FEz9tttu; arc=none smtp.client-ip=209.85.128.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FEz9tttu" Received: by mail-wm1-f45.google.com with SMTP id 5b1f17b1804b1-49800c6a846so14346715e9.3 for ; Wed, 12 Aug 2026 12:53:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786564400; x=1787169200; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vMy4p/Vz5vITJwBEwWHcB2Ir0vh7CqPPuQAXsltndFo=; b=FEz9tttu0rbo8aV8mHj4CzSDtWmAMrV5iqu5FHwf/yEWfzCa/nxRUQag0SlhGv8BRL 1NfG1Im5tnCpS9/eepI8OTrFT1yBmGK4FWsoI4BB5whUUYZAcgKf7r3zMxqeUCVm8Awv LSlKC5vpN6vk1bfTe2IqBXFNKRsW7M4NiwRICEcZ9uSA0SFBj6yZNa76KRSOTJpbzZOo k6t3dGB42H/ADhfzKO9pswZch+93TISQrwVqhHelDXIDsB0xn0/Pni2whE5tppHHB7yy 0Xq67pR7XhtWB10IukS9vaR/ZA6DEpmGQMtcXfxylFox0OgCA8DsYMXjOOHNMtuMp3LA S89A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786564400; x=1787169200; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=vMy4p/Vz5vITJwBEwWHcB2Ir0vh7CqPPuQAXsltndFo=; b=Q3ski7XH2YPDSESORJnuWpWmVYxsUf05fP/hVpYYMUhlwoG9iymp0GEeM/dZtIBoKS rvpbqWLU7FU2/YrdQbsTA0PHL9nPUun+VNLemEflKTeKP6fHqI95M3iZOAEkPuf7REDd o1s7WvHe2pQSBcYgkmw/SkCPcL8BJPOjD42CUu7zxhlUWAJqPVhIxJ2XjBgT2VKd/v20 RkLyx/R7z/MsbwahTiu2DfTIGCWoF4pScEAmj/bIRodnq+MLYTVj2pV/NtDfdX5QvdFl zOTJi9hXczeQDgO80WAOetQwzbsg5A7KyB0UQ9BHpyUH9x4c36mcvNpJRltv+28GwfQF kfLg== X-Gm-Message-State: AOJu0YyNdL07uleg4pu/a8iKGfkJ6nQ1N7gxr3GNI15UJH2j06R2egqh NiQ9PIck7uES2U3hqMSe1H1pjXvIbuaRn1ZWlEMGGovlMmlzJQl6KOIKeQ5U4Fj2 X-Gm-Gg: AR+sD12OiWA0BS0uYD2xmrXt9BSFFXZVTcygzPyGxK/yVqLweDkbeEl/Zm9JhINhjy0 hTkPr4EaIVrZEqamkxGKSs2dprmmUm5So2o7dRvdWUh60K0ApJrgnuZuJ+SJPt0b0ik8gfzsKeQ 0ODJ0JMexcaFtjxt9UIojEqWtUewv8QZfQm6ym3Qx52d3MOkdECbjoZdiU3JNXTe+0AuRte13e5 f1ZvQoar2TU8LpxCbWVHVNSBkylkEewUM8Et13ZudrDrzJauS7+BP8LipX5gwEvCkOka7QSVaDS v9tAKu3xb2HwQ/9mmfjgCifVS/0rRGCeIBMoKNy5Gn82/dRPViCPMYdourN3xrvlw86X9BfbF6e bjR0r0bz8ZF+y0gjWOZbMnfEwb5/LpkRWqSOA+iHkJuMa6kKPHTp4k1LBaq8GI4qe1N+o92+nPw mPYpWJj9FBzUBnoBdM45LWHQ6ovmDyGqcfNyuF9Su61Dg68upW1+A/QT7UawVxukPVQOtJtdFda IswIjexd4ASURubmhw85xpZtAcTV7enYGcoIbLyiH//oSAemw== X-Received: by 2002:a05:600c:358b:b0:499:60bf:c6f7 with SMTP id 5b1f17b1804b1-499821c2ffdmr1196545e9.13.1786564399984; Wed, 12 Aug 2026 12:53:19 -0700 (PDT) Received: from karin-metis-desk.tailaea490.ts.net ([2a06:c701:c1f7:3500:4c98:e58c:bdb:6080]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49981abd6desm13145665e9.0.2026.08.12.12.53.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 12:53:19 -0700 (PDT) From: Tomer Pomeranc To: linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org, arve@android.com, tkjos@android.com, brauner@kernel.org, cmllamas@google.com, aliceryhl@google.com, stable@vger.kernel.org, Tomer Pomeranc Subject: [PATCH 1/2] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede Date: Wed, 12 Aug 2026 22:53:15 +0300 Message-Id: <20260812195316.259136-2-tomerpo@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260812195316.259136-1-tomerpo@gmail.com> References: <20260812195316.259136-1-tomerpo@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree() directly. This skips binder_free_txn_fixups(), leaking all binder_txn_fd_fixup entries and their fget()'d struct file references. The leaked file refcounts never reach zero, so the struct file objects are permanently pinned in memory. They survive process exit and accumulate across invocations until file-max exhaustion. Every other transaction cleanup path (binder_free_transaction(), binder_transaction() error paths, binder_release_work()) correctly calls binder_free_txn_fixups(). Add the missing call before kfree() in the t_outdated cleanup block. Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn") Cc: stable@vger.kernel.org Signed-off-by: Tomer Pomeranc Acked-by: Carlos Llamas --- drivers/android/binder.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 8f2ef1bd5..f70aeb63a 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2932,6 +2932,7 @@ static int binder_proc_transaction(struct binder_tran= saction *t, trace_binder_transaction_update_buffer_release(buffer); binder_release_entire_buffer(proc, NULL, buffer, false); binder_alloc_free_buf(&proc->alloc, buffer); + binder_free_txn_fixups(t_outdated); kfree(t_outdated); binder_stats_deleted(BINDER_STAT_TRANSACTION); } --=20 2.34.1 From nobody Tue Sep 29 04:10:17 2026 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5918238944D for ; Wed, 12 Aug 2026 19:53:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786564405; cv=none; b=UlN8VJmlBwCIsD/7zhFPFbczjnibd63u9ATsn3yGEALNIg8KG/pqocNeIOBbTjgp/ZlKOg/HlPd/TJ14b1096jlCv1t1rJgAhP//QotvNli6XAymS94mO87geuQTeManLVk6wSGfDDVooC9coVYHepaucu9BDl2AjmdnX6jH/44= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786564405; c=relaxed/simple; bh=1W8e4wpZPZLzut4w0LZHjkVlCWXXUAeFpfsFi1oFnRU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Lv/fpSGgMIDQjXAfAEgkhNDfdwNodSj+eulrP6reftYwXq/fs21FMu6Or7ZASZbbOV/IrLFTzlM9MGtrLoDbnSGDalmJ7bConGQMOa7qe30x35fImCkeRqxlVMv4cMG8Lu/47AA15knFssWinFkYcuDxQNGGfPIiFmGAR/P2WyA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=doUeMkQJ; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="doUeMkQJ" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4980dc26022so14232145e9.1 for ; Wed, 12 Aug 2026 12:53:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786564401; x=1787169201; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=T8WtQptPrNpuEEvK66rg9JD+38qbFTV5CtL/lpUnjhw=; b=doUeMkQJ4LLKpDzTP5nXoFnx8hSSq1AXjc3de27EAZod7eDASNA1DDrcbTHcpgE0CH UXec5PdUnzNE2Cb5NB31RTz9Xd50HoVs1o0S0Rs8oqJrRQZwfZvOy/tRVr2MKt++rnFw Vg9se0vZJV0URqneTjdZx8jHt+q3xZ7ks6zTBNaUogTnC6zTH4F0OovMVrIbgTuNTZ5k BkRYOwuslUVF+g2vcaE6JJ3+XOnZg6urBSMEUaPhhVXcDQevTGo6JZIFOyrp5xZpFLzg FUxtCTx4Ck6wJq+oCxqJ+9FFx7d1GvQUq2LjN1O7CXT9MsfNI0rmpo4mfHKMv3+vrO4K hN4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786564401; x=1787169201; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=T8WtQptPrNpuEEvK66rg9JD+38qbFTV5CtL/lpUnjhw=; b=C8xyx/C6YLR0UIwI2L29gHeS0Gu6vz0HTj+qFXTI0tXPF8q/pPvjATn5P0tAe0zYqu t7ce/0jgzAM0BWtu4UpM9FDTVYJqLkshtgonECRcVfbH8iss7kOqIxpigfWbrb1O7ttC HZ0oJnHktR81oCby5SlWRAc/IKKXWpSQxd7GOdLRxBttqodUSy1v+I3C6XLGq38zockw vJsOaIKcmh0z8sG9/aX5oKJMjZulOEyHyDSpvkiFW3CwWiA/cfkSsQped8lXvVWJhlZR 4gq/c6jF9SfB45Toc2RvKwguACRH2lw3Eog3Qlp+GMdOnvWwp/Uxg2estiBSH9od+8ju c+QQ== X-Gm-Message-State: AOJu0Yw7GHIqh4mQlElp8CL7Y+u+HiIxkHSNAtzO3cb+l+ClBvRYx0nG 30/MqEtvoB/luTYjCpP4wVei8uP5lBzz8VC92TSkO2lyCPFQyPTen66ah2YZq7ZP X-Gm-Gg: AR+sD10uXB+tyz1HF822LeIi8bjnK+uAPmkv2Wdt/3w9wTRd171q8Gl1B+Cjrb0/vJo bOry+3YDPb8o0WUZhjjYPeI5vvKL4GtqPv3Y+xLa9uTE7MpckpwXGF45Vn7ljDX923Wnq2mMPR0 7AbYmSPsx8uhdNsfH5cmRmtJ7UqCNmrNvm3EOBfj+4J5daeiqIyel1cRFifSAuvFNAgZbGPdgU3 fUY4XSofstJQiWG73Mtl9wdk4454f0DvLnPI05VwvIm5EaHNSfozVSWkg7qJ/2XZr/HkfEEHh63 PWEuDeccvUTfChzobimP+S7tvHpxOonkGjxKy9QD+4MhWBzUwEATRQ0S24HrZVXL74tNLBctjzY FGvVlo4kh57jNn7gs2Pa93UHy5t6imc2uAJ6kV9CpX0/Y6W+La1a2YcvVu0bv3e7xpA79/ewkQ4 5F7PPOgXaKsLrI2z1ZY19E1liRkN+v4vGkVLs3y+NNNVVwn/JApKPOUJaJs7LeFmCzq1XuhHyU/ r/bFIpAaFCPNrN6AVgt03bHOgBFMD1pYcj7k4RMMtblYdurwA== X-Received: by 2002:a05:600c:c177:b0:498:1595:be7b with SMTP id 5b1f17b1804b1-499821c5be9mr1430455e9.4.1786564401398; Wed, 12 Aug 2026 12:53:21 -0700 (PDT) Received: from karin-metis-desk.tailaea490.ts.net ([2a06:c701:c1f7:3500:4c98:e58c:bdb:6080]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49981abd6desm13145665e9.0.2026.08.12.12.53.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 12:53:20 -0700 (PDT) From: Tomer Pomeranc To: linux-kernel@vger.kernel.org Cc: gregkh@linuxfoundation.org, arve@android.com, tkjos@android.com, brauner@kernel.org, cmllamas@google.com, aliceryhl@google.com, stable@vger.kernel.org, Tomer Pomeranc Subject: [PATCH 2/2] binder: fix is_failure flag for superseded transaction cleanup Date: Wed, 12 Aug 2026 22:53:16 +0300 Message-Id: <20260812195316.259136-3-tomerpo@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260812195316.259136-1-tomerpo@gmail.com> References: <20260812195316.259136-1-tomerpo@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a TF_UPDATE_TXN transaction supersedes a pending async transaction, binder_release_entire_buffer() is called with is_failure=3Dfalse. Since the superseded transaction was never delivered, binder_apply_fd_fixups() was never called and no fds were installed in the target process. With is_failure=3Dfalse, the BINDER_TYPE_FDA cleanup handler interprets stale buffer contents as installed fd numbers and passes them to binder_deferred_fd_close(), closing unrelated file descriptors. Pass is_failure=3Dtrue since the transaction was never delivered to the target, matching the semantics of all other undelivered-transaction cleanup paths. Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn") Cc: stable@vger.kernel.org Signed-off-by: Tomer Pomeranc Acked-by: Carlos Llamas --- drivers/android/binder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index f70aeb63a..bc8bc9ee4 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2930,7 +2930,7 @@ static int binder_proc_transaction(struct binder_tran= saction *t, t_outdated->buffer =3D NULL; buffer->transaction =3D NULL; trace_binder_transaction_update_buffer_release(buffer); - binder_release_entire_buffer(proc, NULL, buffer, false); + binder_release_entire_buffer(proc, NULL, buffer, true); binder_alloc_free_buf(&proc->alloc, buffer); binder_free_txn_fixups(t_outdated); kfree(t_outdated); --=20 2.34.1