Re: [PATCH 1/2] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

[Carlos Llamas]

On Wed, Aug 12, 2026 at 10:53:15PM +0300, Tomer Pomeranc wrote:
> When a TF_UPDATE_TXN transaction supersedes a pending async transaction
> in a frozen process, the outdated transaction is freed with kfree()
> directly. This skips binder_free_txn_fixups(), leaking all
> binder_txn_fd_fixup entries and their fget()'d struct file references.
> 
> The leaked file refcounts never reach zero, so the struct file objects
> are permanently pinned in memory. They survive process exit and
> accumulate across invocations until file-max exhaustion.
> 
> Every other transaction cleanup path (binder_free_transaction(),
> binder_transaction() error paths, binder_release_work()) correctly
> calls binder_free_txn_fixups(). Add the missing call before kfree()
> in the t_outdated cleanup block.
> 
> Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tomer Pomeranc <tomerpo@xxxxxxxxx>
> ---
>  drivers/android/binder.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 8f2ef1bd5..f70aeb63a 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2932,6 +2932,7 @@ static int binder_proc_transaction(struct binder_transaction *t,
>  		trace_binder_transaction_update_buffer_release(buffer);
>  		binder_release_entire_buffer(proc, NULL, buffer, false);
>  		binder_alloc_free_buf(&proc->alloc, buffer);
> +		binder_free_txn_fixups(t_outdated);
>  		kfree(t_outdated);
>  		binder_stats_deleted(BINDER_STAT_TRANSACTION);
>  	}
> -- 
> 2.34.1
> 

Thanks,
Acked-by: Carlos Llamas <cmllamas@xxxxxxxxxx>