Re: [PATCH] binder: fix buffer/node leak and premature fd_install on read -EFAULT

[Carlos Llamas <cmllamas@google.com>]

On Sat, Sep 19, 2026 at 09:36:49PM +0000, Hui Peng wrote:
> In `binder_thread_read()`, `binder_apply_fd_fixups()` installs
> translated file descriptors into `current->files` via `fd_install()`
> BEFORE `put_user()` and `copy_to_user()` copy the `BR_TRANSACTION` /
> `BR_REPLY` command and `binder_transaction_data` payload to userspace.
> 
> If `put_user()` or `copy_to_user()` returns `-EFAULT`:
> 
> 1. Any file descriptors in `t->fd_fixups` have already been installed
>    into the recipient process's file descriptor table and removed from
>    `t->fd_fixups`, even though the transaction failed and the sender
>    receives `BR_FAILED_REPLY`.
> 2. Unlike the `binder_apply_fd_fixups()` failure path immediately above
>    it, the `put_user()` and `copy_to_user()` failure paths call
>    `binder_cleanup_transaction()` without setting
>    `t->buffer->transaction = NULL` or calling `binder_free_buf(proc,
>    thread, buffer, true)`. Because `allow_user_free` is still `0`, the
>    `binder_buffer` and all translated `binder_node`/`binder_ref`
>    references inside it are permanently leaked, and for `TF_ONE_WAY`
>    transactions `node->has_async_transaction` remains `true` forever,
>    wedging all subsequent async transactions to that node.
> 
> Split `fd_install()` out of `binder_apply_fd_fixups()` into
> `binder_fd_fixups_install(t)` called only after `put_user()` and
> `copy_to_user()` succeed, and free `t->buffer` via
> `binder_free_buf(proc, thread, buffer, true)` on `-EFAULT`.
> 
> Fixes: 44d8047f1d87 ("binder: use standard functions to allocate fds")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> 
> ---
>  drivers/android/binder.c | 30 +++++++++++++++++++++++-------
>  1 file changed, 23 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index fb9ff072bd6c..efff59853752 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -4705,7 +4705,7 @@ static int binder_wait_for_work(struct binder_thread *thread,
>  static int binder_apply_fd_fixups(struct binder_proc *proc,
>  				  struct binder_transaction *t)
>  {
> -	struct binder_txn_fd_fixup *fixup, *tmp;
> +	struct binder_txn_fd_fixup *fixup;
>  	int ret = 0;
>  
>  	list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) {
> @@ -4730,19 +4730,25 @@ static int binder_apply_fd_fixups(struct binder_proc *proc,
>  			goto err;
>  		}
>  	}
> -	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
> -		fd_install(fixup->target_fd, fixup->file);
> -		list_del(&fixup->fixup_entry);
> -		kfree(fixup);
> -	}
>  
> -	return ret;
> +	return 0;
>  
>  err:
>  	binder_free_txn_fixups(t);
>  	return ret;
>  }
>  
> +static void binder_fd_fixups_install(struct binder_transaction *t)
> +{
> +	struct binder_txn_fd_fixup *fixup, *tmp;
> +
> +	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
> +		fd_install(fixup->target_fd, fixup->file);
> +		list_del(&fixup->fixup_entry);
> +		kfree(fixup);
> +	}
> +}
> +
>  static int binder_thread_read(struct binder_proc *proc,
>  			      struct binder_thread *thread,
>  			      binder_uintptr_t binder_buffer, size_t size,
> @@ -5121,26 +5127,36 @@ static int binder_thread_read(struct binder_proc *proc,
>  			trsize = sizeof(tr);
>  		}
>  		if (put_user(cmd, (uint32_t __user *)ptr)) {
> +			struct binder_buffer *buffer = t->buffer;
> +
>  			if (t_from)
>  				binder_thread_dec_tmpref(t_from);
>  
> +			buffer->transaction = NULL;
>  			binder_cleanup_transaction(t, "put_user failed",
>  						   BR_FAILED_REPLY);
> +			binder_free_buf(proc, thread, buffer, true);
>  
>  			return -EFAULT;
>  		}
>  		ptr += sizeof(uint32_t);
>  		if (copy_to_user(ptr, &tr, trsize)) {
> +			struct binder_buffer *buffer = t->buffer;
> +
>  			if (t_from)
>  				binder_thread_dec_tmpref(t_from);
>  
> +			buffer->transaction = NULL;
>  			binder_cleanup_transaction(t, "copy_to_user failed",
>  						   BR_FAILED_REPLY);
> +			binder_free_buf(proc, thread, buffer, true);
>  
>  			return -EFAULT;
>  		}
>  		ptr += trsize;
>  
> +		binder_fd_fixups_install(t);
> +
>  		trace_binder_transaction_received(t);
>  		binder_stat_br(proc, thread, cmd);
>  		binder_debug(BINDER_DEBUG_TRANSACTION,
> -- 
> 2.55.0.1082.g2b9226bbc0-goog
> 

This seems correct. Although I assume you'll be sending a new patchset
addressing Greg's feedback right? e.g.

https://lore.kernel.org/all/2026092022-wad-vertigo-3361@gregkh/