Fix two state rollback bugs when `BINDER_FREEZE` fails with `-EAGAIN`:

1. In `binder_ioctl_freeze()`, `target_proc->is_frozen = true` is set
   before waiting for pending transactions to drain. If
   `wait_event_interruptible_timeout()` times out with `-EAGAIN`,
   `binder_ioctl_freeze()` resets `target_proc->is_frozen = false` but
   omits calling `binder_add_freeze_work(target_proc, false)`, leaving
   any `BINDER_WORK_FROZEN_INFO` state queued during the freeze window
   un-cleared.
2. In `binder_ioctl()` (`BINDER_FREEZE`), a single PID can own multiple
   `binder_proc` instances (`target_procs[]`). If
   `binder_ioctl_freeze()` succeeds on `target_procs[0]` (`is_frozen =
   true`) and then fails with `-EAGAIN` on `target_procs[1]`, the loop
   exits and returns `-EAGAIN` to userspace while leaving
   `target_procs[0]` permanently frozen. Unfreeze any previously frozen
   `target_procs[0..i-1]` when `binder_ioctl_freeze()` fails.

Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl")
Fixes: d579b04a52a1 ("binder: frozen notification")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 drivers/android/binder.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 8f2ef1bd539f..1c7218e599a1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5732,6 +5756,7 @@ static int binder_ioctl_freeze(struct binder_freeze_info *info,
 		binder_inner_proc_lock(target_proc);
 		target_proc->is_frozen = false;
 		binder_inner_proc_unlock(target_proc);
+		binder_add_freeze_work(target_proc, false);
 	} else {
 		binder_add_freeze_work(target_proc, true);
 	}
@@ -5939,9 +5964,19 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 		mutex_unlock(&binder_procs_lock);
 
 		for (i = 0; i < target_procs_count; i++) {
-			if (ret >= 0)
+			if (ret >= 0) {
 				ret = binder_ioctl_freeze(&info,
 							  target_procs[i]);
+				if (ret < 0 && info.enable) {
+					struct binder_freeze_info unfreeze = info;
+					int j;
+
+					unfreeze.enable = 0;
+					for (j = 0; j < i; j++)
+						binder_ioctl_freeze(&unfreeze,
+								    target_procs[j]);
+				}
+			}
 
 			binder_proc_dec_tmpref(target_procs[i]);
 		}

On Sat, Sep 19, 2026 at 09:36:52PM +0000, Hui Peng wrote:
> Fix two state rollback bugs when `BINDER_FREEZE` fails with `-EAGAIN`:
> 
> 1. In `binder_ioctl_freeze()`, `target_proc->is_frozen = true` is set
>    before waiting for pending transactions to drain. If
>    `wait_event_interruptible_timeout()` times out with `-EAGAIN`,
>    `binder_ioctl_freeze()` resets `target_proc->is_frozen = false` but
>    omits calling `binder_add_freeze_work(target_proc, false)`, leaving
>    any `BINDER_WORK_FROZEN_INFO` state queued during the freeze window
>    un-cleared.

This is incorrect. The current implementation doesn't add the work for
"proc->is_frozen = true" until _after_ the timeout has passed. So adding
another binder_add_freeze_work(target_proc, false) is incorrect.

> 2. In `binder_ioctl()` (`BINDER_FREEZE`), a single PID can own multiple
>    `binder_proc` instances (`target_procs[]`). If
>    `binder_ioctl_freeze()` succeeds on `target_procs[0]` (`is_frozen =
>    true`) and then fails with `-EAGAIN` on `target_procs[1]`, the loop
>    exits and returns `-EAGAIN` to userspace while leaving
>    `target_procs[0]` permanently frozen. Unfreeze any previously frozen
>    `target_procs[0..i-1]` when `binder_ioctl_freeze()` fails.

This is a real issue. However, I'm already fixing this and _other_
issues with this API here:

https://r.android.com/4254406

> 
> Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl")
> Fixes: d579b04a52a1 ("binder: frozen notification")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>