1 files changed, 12 insertions, 9 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cb30a524d16d..9f1000d2a40c 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2974,7 +2974,6 @@ static void binder_transaction(struct binder_proc *proc,
                 t->buffer = NULL;
                 goto err_binder_alloc_buf_failed;
         }
-        t->buffer->allow_user_free = 0;
         t->buffer->debug_id = t->debug_id;
         t->buffer->transaction = t;
         t->buffer->target_node = target_node;
@@ -3510,14 +3509,18 @@ static int binder_thread_write(struct binder_proc *proc,
 
                         buffer = binder_alloc_prepare_to_free(&proc->alloc,
                                                               data_ptr);
-                        if (buffer == NULL) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
-                                break;
-                        }
-                        if (!buffer->allow_user_free) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
+                        if (IS_ERR_OR_NULL(buffer)) {
+                                if (PTR_ERR(buffer) == -EPERM) {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                } else {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx no match\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                }
                                 break;
                         }
                         binder_debug(BINDER_DEBUG_FREE_BUFFER,