Re: [PATCH v6 4/4] selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test
"T.J. Mercier" <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.freedesktop.lists.dri-devel,org.kernel.vger.linux-arm-msm,org.kernel.vger.linux-kernel,org.kernel.vger.linux-media |
|---|---|
| Message-ID | <CABdmKX0i_DaS8Q2=Q8Xs5bTbSCj2FFSpib9ReCGYFXSeiBcntw@mail.gmail.com> |
On Fri, Aug 7, 2026 at 3:12 AM Baineng Shou <[email protected]> wrote: > > Add a test case that verifies no file descriptor is leaked when > DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails > to deliver the fd number back to userspace. > > The failure is triggered by placing the ioctl argument in a private > anonymous page and flipping it to PROT_READ (via mprotect) between > the kernel's copy_from_user() and copy_to_user() calls. With the > buggy kernel the ioctl returns -EFAULT but leaves an extra open fd > in the process's fd table; with the fixed kernel the fd count is > unchanged. > > This serves as a regression test for: > "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds" > > Suggested-by: Sumit Semwal <[email protected]> > Signed-off-by: Baineng Shou <[email protected]> Reviewed-by: T.J. Mercier <[email protected]>