From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f182.google.com (mail-pl1-f182.google.com [209.85.214.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13F58395ACC for ; Wed, 12 Aug 2026 21:31:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786570314; cv=none; b=eCut2lkTYwvbpBciWpTiWGM3cb3YXjUVu5vrqjYe/XaUBy5TI+bpZfF86bXzYm4bhm4vJYQ9ymhwEEPb/N8WtgRVWdXDKOnqV2I/FBqqrq2/lyW76G4ocexusXKLTCbeQfBVcTrm0/OY4uWRjG9pa2WGiE92Ytg5dtUirFfYaPw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786570314; c=relaxed/simple; bh=nNIHFubT2cdwMRGC5wo1PMzn8c+9vm4K2D/LERMWOlM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=HST39bDWSEuqSPzHEiVTogi090KZW5+RK3rLf0lHyzY6E4YXCxSMAuMJ1nXeqgJTxvOSo4r0V7tgI3w9g81Fg3W0D7Do3cmF25mUzT5TgwExJ0hyvTkTx79neGhjxq+RWI9V5PNnTjMVBoLUGi3PPsXIYFqeNiWE/Qkx4DnO6gs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ZeCq6ThX; arc=none smtp.client-ip=209.85.214.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ZeCq6ThX" Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2cacef7d299so12665ad.1 for ; Wed, 12 Aug 2026 14:31:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786570312; x=1787175112; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=wINBx+pfpCyFlfKOWVKljukC1dHM8ILCso1ff2oMmaQ=; b=ZeCq6ThXANmi18Gnlj3wFyqPPVfHiHyxTNbXgzLNceY068UotVuJQcfNkdvKJ7rY+J nCfeCVy/gdMijWw/iUD8jhyDI0t1NwuAgPe6WbixKF+Lk5EsRiVKpE5+NohE+f6FSnYY yCUQofVVzyoZXXR38Bc2MwxD5ScmlGmLTsb0tmjdSlijj9IkWQv9T/zbWUjSGR+J2Dxr hOMAbpxQzs4r9i93JWOjBC7dFeL9BEfh3/5XDEfTqmkkdURVvgzF5F2RuWw/puyIkMLS 0OTrF5taxW4XBzDVCzKndkqgnSKPMOw8xsiBpkv0yMNteR0rCdScqGQo+BXaQuDVLnTG fpqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786570312; x=1787175112; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=wINBx+pfpCyFlfKOWVKljukC1dHM8ILCso1ff2oMmaQ=; b=GMEPTXM/XDIboiCEcgEg1d93THQu3Y7ZPqB0lHCbv13lNjZJw8GLtFdpd0Y0D8chYS 5U22kdpGKsEhYT+MrFua3vZpO7yAX1mvaIa8oSNtWQ8IzeWaNHhEvn7tVXE9U25G/C7p a3/AueQtQ9O5G92X7LTzM5rMf/2efb3UQ/P42onhEGyknGTm11bowWiBSTKYp0AUppqi TXhvcRz7LbrD6HVucDIOYlE3gVoyeM1TSKwt1cSwlWIs9f7UZ+Csu3RuThub1hQfQH3G c//m4hM9414Nqyw7mYrcY8I4HZ3cFhQ4svpkdpm+rNElRsqGDvUNbD7qKpkSHpqLWpwM Rmqg== X-Gm-Message-State: AOJu0YwuU2kr6BqHiBJHOX9k9CwPnXVnF8nZha/KKNqhgl03Qj8voeLe lEnaHTNFrEqNP8r3hVDWr2Sh+vtL1Cga1yD4dR3cVS1MkNt0jF5dIMSkVIXgpxJrNQ== X-Gm-Gg: AR+sD11nUiKJDPJ5/LBZA96+Ysx6ZbkfZ0ndkijrp+MlhQyBEsDnwOi8+v7fhjugPmc 9XZjpfHMtS573Psuj0Y8L21li82snwitSWIzw++9Wz5X0OXBRum1R3dICMOYPVBYYzxT409nPRa BXOtx/8ykvRHJydlt17HBA/SMSPZEGyxbqaIbwpXNBmbphEo+7D/icjMx34+d8FIBaKViylu8p6 Ytg+jZAhw21cD3Rq3dm6Hgo00x5JxMwTxH/Vm66BfBv5KifiLXWEVObm3iy9R0AQ4DWOPJcXKhH 8Sx7/WB3uD544DPw3zTtqd5o1uxnFUIHtqnK/i2gYtEXY5VV3vbEWvCH/ckuyxl0j9+ZIPwvh7t T6bJR0fzlc+ZSaRciJaJS7jAJc6w3QoiQU1sHRkPlYMWdda+BFjN3O6MzhPq9CY30LiwhQB0ZC7 MUjE+yIy7AtWkmU2i7mhKagMEd3sgZFPsWDbEtqXCM5BEpIP6/aCUdYNcklb5AtfAi+iYuSIFEp BXHXpCgQsGbSSrLj3bZwuRivKhC7XWj8Fy9upZOTUffdBObk919GNondGV4LGr+H0jiJHUcJLIH GX6EXD8q X-Received: by 2002:a17:903:32d0:b0:2bf:3579:cdaa with SMTP id d9443c01a7336-2d388a6cdb9mr57115ad.10.1786570311823; Wed, 12 Aug 2026 14:31:51 -0700 (PDT) Received: from google.com (193.67.125.34.bc.googleusercontent.com. [34.125.67.193]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d37c221d24sm1708235ad.20.2026.08.12.14.31.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 14:31:51 -0700 (PDT) Date: Wed, 12 Aug 2026 21:31:47 +0000 From: Carlos Llamas To: Tomer Pomeranc Cc: linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, arve@android.com, tkjos@android.com, brauner@kernel.org, aliceryhl@google.com, stable@vger.kernel.org Subject: Re: [PATCH 1/2] binder: fix leaked fd fixups on TF_UPDATE_TXN supersede Message-ID: References: <20260812195316.259136-1-tomerpo@gmail.com> <20260812195316.259136-2-tomerpo@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260812195316.259136-2-tomerpo@gmail.com> On Wed, Aug 12, 2026 at 10:53:15PM +0300, Tomer Pomeranc wrote: > When a TF_UPDATE_TXN transaction supersedes a pending async transaction > in a frozen process, the outdated transaction is freed with kfree() > directly. This skips binder_free_txn_fixups(), leaking all > binder_txn_fd_fixup entries and their fget()'d struct file references. > > The leaked file refcounts never reach zero, so the struct file objects > are permanently pinned in memory. They survive process exit and > accumulate across invocations until file-max exhaustion. > > Every other transaction cleanup path (binder_free_transaction(), > binder_transaction() error paths, binder_release_work()) correctly > calls binder_free_txn_fixups(). Add the missing call before kfree() > in the t_outdated cleanup block. > > Fixes: 9864bb480133 ("binder: add TF_UPDATE_TXN to replace outdated txn") > Cc: stable@vger.kernel.org > Signed-off-by: Tomer Pomeranc > --- > drivers/android/binder.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index 8f2ef1bd5..f70aeb63a 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -2932,6 +2932,7 @@ static int binder_proc_transaction(struct binder_transaction *t, > trace_binder_transaction_update_buffer_release(buffer); > binder_release_entire_buffer(proc, NULL, buffer, false); > binder_alloc_free_buf(&proc->alloc, buffer); > + binder_free_txn_fixups(t_outdated); > kfree(t_outdated); > binder_stats_deleted(BINDER_STAT_TRANSACTION); > } > -- > 2.34.1 > Thanks, Acked-by: Carlos Llamas