[PATCH] binder: fix buffer/node leak and premature fd_install on read -EFAULT

[Hui Peng]

In `binder_thread_read()`, `binder_apply_fd_fixups()` installs
translated file descriptors into `current->files` via `fd_install()`
BEFORE `put_user()` and `copy_to_user()` copy the `BR_TRANSACTION` /
`BR_REPLY` command and `binder_transaction_data` payload to userspace.

If `put_user()` or `copy_to_user()` returns `-EFAULT`:

1. Any file descriptors in `t->fd_fixups` have already been installed
   into the recipient process's file descriptor table and removed from
   `t->fd_fixups`, even though the transaction failed and the sender
   receives `BR_FAILED_REPLY`.
2. Unlike the `binder_apply_fd_fixups()` failure path immediately above
   it, the `put_user()` and `copy_to_user()` failure paths call
   `binder_cleanup_transaction()` without setting
   `t->buffer->transaction = NULL` or calling `binder_free_buf(proc,
   thread, buffer, true)`. Because `allow_user_free` is still `0`, the
   `binder_buffer` and all translated `binder_node`/`binder_ref`
   references inside it are permanently leaked, and for `TF_ONE_WAY`
   transactions `node->has_async_transaction` remains `true` forever,
   wedging all subsequent async transactions to that node.

Split `fd_install()` out of `binder_apply_fd_fixups()` into
`binder_fd_fixups_install(t)` called only after `put_user()` and
`copy_to_user()` succeed, and free `t->buffer` via
`binder_free_buf(proc, thread, buffer, true)` on `-EFAULT`.

Fixes: 44d8047f1d87 ("binder: use standard functions to allocate fds")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>

---
 drivers/android/binder.c | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index fb9ff072bd6c..efff59853752 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -4705,7 +4705,7 @@ static int binder_wait_for_work(struct binder_thread *thread,
 static int binder_apply_fd_fixups(struct binder_proc *proc,
 				  struct binder_transaction *t)
 {
-	struct binder_txn_fd_fixup *fixup, *tmp;
+	struct binder_txn_fd_fixup *fixup;
 	int ret = 0;
 
 	list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) {
@@ -4730,19 +4730,25 @@ static int binder_apply_fd_fixups(struct binder_proc *proc,
 			goto err;
 		}
 	}
-	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
-		fd_install(fixup->target_fd, fixup->file);
-		list_del(&fixup->fixup_entry);
-		kfree(fixup);
-	}
 
-	return ret;
+	return 0;
 
 err:
 	binder_free_txn_fixups(t);
 	return ret;
 }
 
+static void binder_fd_fixups_install(struct binder_transaction *t)
+{
+	struct binder_txn_fd_fixup *fixup, *tmp;
+
+	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
+		fd_install(fixup->target_fd, fixup->file);
+		list_del(&fixup->fixup_entry);
+		kfree(fixup);
+	}
+}
+
 static int binder_thread_read(struct binder_proc *proc,
 			      struct binder_thread *thread,
 			      binder_uintptr_t binder_buffer, size_t size,
@@ -5121,26 +5127,36 @@ static int binder_thread_read(struct binder_proc *proc,
 			trsize = sizeof(tr);
 		}
 		if (put_user(cmd, (uint32_t __user *)ptr)) {
+			struct binder_buffer *buffer = t->buffer;
+
 			if (t_from)
 				binder_thread_dec_tmpref(t_from);
 
+			buffer->transaction = NULL;
 			binder_cleanup_transaction(t, "put_user failed",
 						   BR_FAILED_REPLY);
+			binder_free_buf(proc, thread, buffer, true);
 
 			return -EFAULT;
 		}
 		ptr += sizeof(uint32_t);
 		if (copy_to_user(ptr, &tr, trsize)) {
+			struct binder_buffer *buffer = t->buffer;
+
 			if (t_from)
 				binder_thread_dec_tmpref(t_from);
 
+			buffer->transaction = NULL;
 			binder_cleanup_transaction(t, "copy_to_user failed",
 						   BR_FAILED_REPLY);
+			binder_free_buf(proc, thread, buffer, true);
 
 			return -EFAULT;
 		}
 		ptr += trsize;
 
+		binder_fd_fixups_install(t);
+
 		trace_binder_transaction_received(t);
 		binder_stat_br(proc, thread, cmd);
 		binder_debug(BINDER_DEBUG_TRANSACTION,
-- 
2.55.0.1082.g2b9226bbc0-goog