From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C2F013FF1B5 for ; Wed, 12 Aug 2026 21:31:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786570294; cv=none; b=Zi6vpeCSMWGwKOM1s0ZpKsbGBgbfirWixhBr3pa/4rPe+fO1+g/5SCKzH0iltoo/t+cXm8vMs/dfve8pwSCqpFeDuqTS408mBMNHoGzev7EmciSbDX6hUaqf4JR1PD8HSi0Ode0CZM0LBJqnTEaWycB3/t5X2t25l+cRmE4r1bU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786570294; c=relaxed/simple; bh=eiAdnY9uyHvwwRccJiE84KcM5Abkourdof8GwKi9sxE=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=kzW7yjHajEeKj+dzfjH+UiM/7UOY0C48ppO+HZ8Xyp2IoxkjMGTnxLFbW+TEy/IWF4DNbcpwm69d66OBNNeZ7ayF3AoRUFE7OwsYjEpi5nvA/j0vg7XrktBWNqg4AFYAdU9mH9zo8riePj+KtkG/yMjreT7MlpcaPxrSmE8+3zA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=SzZqQ7Lc; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="SzZqQ7Lc" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2cacef7d299so12615ad.1 for ; Wed, 12 Aug 2026 14:31:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786570292; x=1787175092; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=adU9pSYSvOZv0vGMn9GbsdCEmXxJG3xNFehX0PTMJFA=; b=SzZqQ7Lcw4fMJW2UCXaSmvSofj899LPVqWuz+Itv8Gl7uIOrsT0IHTNYt4uFN3ZuuS sGZtC+qPpzPbjtVczjieKr/csl6w02rCJln515/Jg+yuqy3SJ6YFNvvDp9Vdgi0DE0eT ExboNDKC7IlfRNQodUUri5yQQILNngFtFHwEt1HxjwZ3ARvH99eCjLe9rHat3y55r/Or 9POwD8XnH47bdMOnYqAdIDjPnJuvNF2HVbKm3zCTFcK+5qQN1BbokvTklP54K7e8Vv7g SCRVwjJPRN+lIrpAH14qmEQXyrNzDJxrx+w4QHAETej2qjOgDagWzidlaXqqngckMU+x LdHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786570292; x=1787175092; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=adU9pSYSvOZv0vGMn9GbsdCEmXxJG3xNFehX0PTMJFA=; b=n042S2Smgot8GycdC0DRZqu9b2JLF5nBOTka2/xpeJ89QhCiC5Wug3ScJOMu/tFxGf No8YVZ966tnMf35UD2a9Q/vHjsyhNOLzRhFfBk97yV/64Hmn2Gd3Y710SnaKgx9kBFrL veia6DDJMQBlawFnNRQkLujK20+9IF5VeqS07M1qqpxSxE4CLwogSJF13zcwOmN3u9TD yFsluFWLI8GMyrSFQ44Rew+o2rE2bueu9WvTli7Izp0e66+HGUyU85HUlBWzkAywBk3D 4cW47cF6lCHySt29ag7ABWJPWlMrWL96qNGXPxPLXsEAi/l6tbmrjI3QAT5jj3CvKH6T PaDA== X-Gm-Message-State: AOJu0YyQjmJElyiNkyr/5rFpCd1RrCrvZxz9qjTqUlucPZaHWCO9uUe5 7QYt3nawIJMRdCJKntS4x32HdMkkQsxhgggB6prhKm0yjc3vTHuSk1N2BaO5L6IcGQ== X-Gm-Gg: AR+sD11Fe1SHVTNlBBiFA/BmEu1bre4lXt4PuJSAFIEyvjOJp28eDdMnmZHFr9je1ZK xTEc+A3UNM549FgAlgi+n2T9z+aqMGmZq9+N7pp7B2nLWw4pEN/chnHuuz5rw1cnipntsNxpgcr DP/+3j0Vn0Np2QOvqjneqh9so3eQ6df7uJNUyfDGVvXtnjz9/fGdz13YpRZ8nxRCWXBoPUmPNky wC1sPKK8asXKl4kO/zKL9hNnusmAGaneGPTfl7Ns9wQZvqDQllc5CwlYiSVwbEbKA55RfC2z0p4 SFwpoNsqQCMH6wKDTWOUU5Nl3ON1reFlywY2yoHZxBfC6y5UejHuGlLRZ4fezC4B8JOaLueZs5Q eCYMHeCHNNezPvVdgQ7SWHZW2jBgy4MBppaQM9S2lxaTdy9vUmdEF/TwonVwjcqsR74TDsTXiel Y8cxuSO4OQ+2ahIKKND2jr/5StvAYPMR5QTn8txvfNd+Hh22zfkpSIAMGpWONFK6pqnBP0kWmEC N3J0hqfKRE4c4gJWAaL1VVnrULGsZPd5KU5uxex86wZYLF4ib15DBHNUJFhCjaVrWRANd1+So9S hdnPNluT X-Received: by 2002:a17:902:cec7:b0:2bf:1000:d3ac with SMTP id d9443c01a7336-2d384c9bf27mr433665ad.11.1786570291443; Wed, 12 Aug 2026 14:31:31 -0700 (PDT) Received: from google.com (193.67.125.34.bc.googleusercontent.com. [34.125.67.193]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84fc4781978sm142558b3a.20.2026.08.12.14.31.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 14:31:29 -0700 (PDT) Date: Wed, 12 Aug 2026 21:31:24 +0000 From: Carlos Llamas To: Tomer Pomeranc Cc: linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, arve@android.com, tkjos@android.com, brauner@kernel.org, aliceryhl@google.com, stable@vger.kernel.org Subject: Re: [PATCH 2/2] binder: fix is_failure flag for superseded transaction cleanup Message-ID: References: <20260812195316.259136-1-tomerpo@gmail.com> <20260812195316.259136-3-tomerpo@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260812195316.259136-3-tomerpo@gmail.com> On Wed, Aug 12, 2026 at 10:53:16PM +0300, Tomer Pomeranc wrote: > When a TF_UPDATE_TXN transaction supersedes a pending async transaction, > binder_release_entire_buffer() is called with is_failure=false. Since the > superseded transaction was never delivered, binder_apply_fd_fixups() was > never called and no fds were installed in the target process. > > With is_failure=false, the BINDER_TYPE_FDA cleanup handler interprets > stale buffer contents as installed fd numbers and passes them to > binder_deferred_fd_close(), closing unrelated file descriptors. > > Pass is_failure=true since the transaction was never delivered to the > target, matching the semantics of all other undelivered-transaction > cleanup paths. > > Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn") > Cc: stable@vger.kernel.org > Signed-off-by: Tomer Pomeranc > --- > drivers/android/binder.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index f70aeb63a..bc8bc9ee4 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -2930,7 +2930,7 @@ static int binder_proc_transaction(struct binder_transaction *t, > t_outdated->buffer = NULL; > buffer->transaction = NULL; > trace_binder_transaction_update_buffer_release(buffer); > - binder_release_entire_buffer(proc, NULL, buffer, false); > + binder_release_entire_buffer(proc, NULL, buffer, true); > binder_alloc_free_buf(&proc->alloc, buffer); > binder_free_txn_fixups(t_outdated); > kfree(t_outdated); > -- > 2.34.1 > Thanks, Acked-by: Carlos Llamas