Re: [PATCH] binder: roll back frozen state and enqueue freeze work on BINDER_FREEZE error

[Carlos Llamas <cmllamas@google.com>]

On Sat, Sep 19, 2026 at 09:36:52PM +0000, Hui Peng wrote:
> Fix two state rollback bugs when `BINDER_FREEZE` fails with `-EAGAIN`:
> 
> 1. In `binder_ioctl_freeze()`, `target_proc->is_frozen = true` is set
>    before waiting for pending transactions to drain. If
>    `wait_event_interruptible_timeout()` times out with `-EAGAIN`,
>    `binder_ioctl_freeze()` resets `target_proc->is_frozen = false` but
>    omits calling `binder_add_freeze_work(target_proc, false)`, leaving
>    any `BINDER_WORK_FROZEN_INFO` state queued during the freeze window
>    un-cleared.

This is incorrect. The current implementation doesn't add the work for
"proc->is_frozen = true" until _after_ the timeout has passed. So adding
another binder_add_freeze_work(target_proc, false) is incorrect.

> 2. In `binder_ioctl()` (`BINDER_FREEZE`), a single PID can own multiple
>    `binder_proc` instances (`target_procs[]`). If
>    `binder_ioctl_freeze()` succeeds on `target_procs[0]` (`is_frozen =
>    true`) and then fails with `-EAGAIN` on `target_procs[1]`, the loop
>    exits and returns `-EAGAIN` to userspace while leaving
>    `target_procs[0]` permanently frozen. Unfreeze any previously frozen
>    `target_procs[0..i-1]` when `binder_ioctl_freeze()` fails.

This is a real issue. However, I'm already fixing this and _other_
issues with this API here:

https://r.android.com/4254406

> 
> Fixes: 432ff1e91694 ("binder: BINDER_FREEZE ioctl")
> Fixes: d579b04a52a1 ("binder: frozen notification")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>