Re: [PATCH] binder: fix sender fd 0 close and file refcount leak on TF_UPDATE_TXN

[Greg KH <gregkh@linuxfoundation.org>]

On Sat, Sep 19, 2026 at 09:36:48PM +0000, Hui Peng wrote:
> In `binder_proc_transaction()`, when a oneway transaction with
> `TF_UPDATE_TXN` supersedes an outdated pending transaction
> (`t_outdated`), the driver calls `binder_release_entire_buffer(proc,
> NULL, buffer, false)` and `kfree(t_outdated)`.
> 
> Passing `is_failure = false` while `buffer->transaction` has already
> been set to `NULL` causes two bugs when `t_outdated` contained
> `BINDER_TYPE_FDA` or `BINDER_TYPE_FD` objects:
> 
> 1. For `BINDER_TYPE_FDA`, `binder_translate_fd_array()` never wrote
>    recipient file descriptors into the buffer (it only appended `struct
>    file *` entries to `t_outdated->fd_fixups`), so the FD array in
>    `buffer` still contains zeros (or sender-supplied offsets). Because
>    `is_failure` is `false`, `binder_transaction_buffer_release()`
>    executes the `!is_failure` branch on `BINDER_TYPE_FDA` and calls
>    `binder_deferred_fd_close(fd)` (closing `fd 0` in `current->files`,
>    which is the **sender** process!).
> 2. `t_outdated` is freed via `kfree(t_outdated)` without calling
>    `binder_free_txn_fixups(t_outdated)`, permanently leaking every
>    translated `struct file` reference in `t_outdated->fd_fixups`.
> 
> Pass `is_failure = true` to `binder_release_entire_buffer()` and call
> `binder_free_txn_fixups(t_outdated)` before freeing `t_outdated`.

Please delete all LLM-generated changelog text and rewrite it in your
own words to explain the problem and why this patch is needed (same for
your other 6 patches).  Also, how were these all tested?

thanks,

greg k-h