Re: [PATCH v2 0/2] binder: fix premature fd_install() and buffer leak on read -EFAULT

[Greg KH]

On Thu, Sep 24, 2026 at 10:00:17AM +0000, Hui Peng wrote:
> This series fixes two error-handling issues in binder_thread_read():
> 
> 1. Defer fd_install() until after put_user() and copy_to_user() succeed,
>    preventing file descriptors from being prematurely installed into the
>    recipient process's file descriptor table when userspace copy fails.
> 2. Call binder_free_buf() on -EFAULT error paths in binder_thread_read() so
>    the transaction buffer and associated node/ref references are freed.
> 
> Changes in v2:
> - Split into a 2-patch series with separate single-purpose commits as
>   requested by Greg Kroah-Hartman and Carlos Llamas.
> - Added Reviewed-by tag from Carlos Llamas.
> 
> Hui Peng (2):
>   binder: defer fd_install() until after copy_to_user() in binder_thread_read()
>   binder: free transaction buffer via binder_free_buf() on read -EFAULT
> 
>  drivers/android/binder.c | 30 +++++++++++++++++++++++-------
>  1 file changed, 23 insertions(+), 7 deletions(-)
> 

Why is this in the middle of the previous set of patches?

And is this still needed?

confused,

greg k-h