Re: [PATCH] binder: free transaction buffer in binder_release_work() on BINDER_THREAD_EXIT

[Carlos Llamas]

On Sat, Sep 19, 2026 at 09:36:51PM +0000, Hui Peng wrote:
> When a binder thread exits via `BINDER_THREAD_EXIT` (`binder_ioctl()` ->
> `binder_thread_release()`) while the process itself is still alive
> (`!proc->is_dead`), `binder_release_work(proc, &thread->todo)` drains
> pending `BINDER_WORK_TRANSACTION` items queued specifically on
> `thread->todo`.
> 
> For each `BINDER_WORK_TRANSACTION`, `binder_release_work()` calls
> `binder_cleanup_transaction(t, "process died.", BR_DEAD_REPLY)` without
> clearing `t->buffer->transaction` or calling `binder_free_buf(proc,
> NULL, buffer, true)`. Because `allow_user_free` is still `0` (the
> transaction was never read by userspace) and `proc` is still alive
> (`binder_deferred_release()` will not run until the process exits),
> `t->buffer` and all translated `binder_node`/`binder_ref` references
> inside `t->buffer` are leaked in the active binder mmap pool, and
> `t->buffer->transaction` is left as a dangling pointer to the freed `t`!

I agree this is a leak. However, the buffer->transaction will also be
cleared so there is no risk of a dangling pointer here.

> 
> Clear `buffer->transaction = NULL` before
> `binder_cleanup_transaction()`, and when `!proc->is_dead && buffer`,
> free `buffer` via `binder_free_buf(proc, NULL, buffer, true)`.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

This commit is again incorrect.

> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> 
> ---
>  drivers/android/binder.c | 18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 8f2ef1bd539f..1c7218e599a1 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -5206,11 +5224,17 @@ static void binder_release_work(struct binder_proc *proc,
>  		switch (wtype) {
>  		case BINDER_WORK_TRANSACTION: {
>  			struct binder_transaction *t;
> +			struct binder_buffer *buffer;
>  
>  			t = container_of(w, struct binder_transaction, work);
> +			buffer = t->buffer;
> +			if (buffer)
> +				buffer->transaction = NULL;
>  
>  			binder_cleanup_transaction(t, "process died.",
>  						   BR_DEAD_REPLY);
> +			if (!proc->is_dead && buffer)
> +				binder_free_buf(proc, NULL, buffer, true);
>  		} break;
>  		case BINDER_WORK_RETURN_ERROR: {
>  			struct binder_error *e = container_of(


The fix itself looks good to me, but could you please fix up the commit
message?

Thanks
Carlos Llamas