Re: [PATCH 0/2] binder: fix TF_UPDATE_TXN supersede cleanup bugs

[Carlos Llamas]

On Wed, Aug 12, 2026 at 10:53:14PM +0300, Tomer Pomeranc wrote:
> Two bugs in the t_outdated cleanup path of binder_proc_transaction(),
> both introduced by commit 9864bb480133 ("binder: add TF_UPDATE_TXN to
> replace outdated txn"):

I was never a fan of this TF_UPDATE_TXN flag. This is a kernel band-aid
patch for a flow-control problem in userspace.

> 
> 1. kfree(t_outdated) is called without binder_free_txn_fixups(),
>    permanently leaking binder_txn_fd_fixup entries and their fget()'d
>    struct file references. The refcount never reaches zero; the leak
>    survives process exit and accumulates until file-max exhaustion.

Yes.

> 
> 2. binder_release_entire_buffer() is called with is_failure=false for
>    a transaction that was never delivered. Since binder_apply_fd_fixups()
>    was never called, the BINDER_TYPE_FDA handler reads stale buffer data
>    as fd numbers and closes unrelated fds via binder_deferred_fd_close().

Ha! good catch.

> 
> Confirmed on mainline Linux (6.8.0-124-generic, binder_linux module)
> and Android (Pixel 8, kernel 6.1.124, /dev/hwbinder).
> 
> Tomer Pomeranc (2):
>   binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
>   binder: fix is_failure flag for superseded transaction cleanup
> 
>  drivers/android/binder.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> -- 
> 2.34.1
> 

So both fixes LGTM, and we should take them.

However, I'm thinking we should drop this code. We now have frozen
process notifications and that should prevent duplicate transactions to
frozen processes from happening in the first place. So we remove the
code and mark TF_UPDATE_TXN as obsolete.

... or maybe we just drop the entire C binder code base. I'm tired of
all these memory issues.

--
Carlos Llamas