From aa2a9884642ac49946a8d1777f6551d2f1bb1062 Mon Sep 17 00:00:00 2001 From: Chris Olin Date: Fri, 30 Oct 2026 16:07:38 -0400 Subject: [PATCH] binder: free the shrinker when binder_init() fails binder_init() registers the shrinker before init_binderfs(). On failure the error path returns without binder_alloc_shrinker_exit(), and a failed module init never runs binder_exit(). The module text is freed while the shrinker stays registered. Mainline fixed this in adb9743d6a08 ("binder: fix memory leak in binder_init()"). Call the existing exit helper on err_alloc_device_names_failed, which is only reached after a successful shrinker init. --- binder/binder.c | 1 + 1 file changed, 1 insertion(+) diff --git a/binder/binder.c b/binder/binder.c index 721902a..805bc6d 100644 --- a/binder/binder.c +++ b/binder/binder.c @@ -6271,6 +6271,7 @@ err_init_binder_device_failed: err_alloc_device_names_failed: debugfs_remove_recursive(binder_debugfs_dir_entry_root); + binder_alloc_shrinker_exit(); return ret; }