Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

110 participants
7214 discussions

Re: [PATCH v3 1/2] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

by Sumit Semwal

Hello Baineng, On Mon, 27 Jul 2026 at 08:56, 寿柏能 <shoubaineng(a)gmail.com> wrote: > > Ping. Any chance this can be picked up? Thank you for the patch. While discussing with T J, we realised that adding a selftest for this would also be helpful. Could you please re-submit with a selftest added? > > Baineng Thanks and best regards, Sumit. > > 寿柏能 <shoubaineng(a)gmail.com> 于2026年7月15日周三 10:04写道： >> >> Hi David >> >> The rollback here is the simplest possible case (put_unused_fd + >> dma_buf_put), not the complex sockopt scenario you describe. >> >> Baineng >> >> David Laight <david.laight.linux(a)gmail.com> 于2026年7月14日周二 22:33写道： >>> >>> On Tue, 14 Jul 2026 21:38:07 +0800 >>> 寿柏能 <shoubaineng(a)gmail.com> wrote: >>> >>> > Hi David, >>> > >>> > Thanks for the feedback. >>> > >>> > The concern is not just about the EFAULT return — it's about the race >>> > window between fd_install() and copy_to_user(). Once fd_install() >>> > returns, the fd is immediately observable by other threads in the same >>> > process (via /proc/self/fd, SCM_RIGHTS, etc.), even before >>> > copy_to_user() has a chance to fail. The triggering condition is a >>> > deliberate mprotect() flip, not a corrupted heap. >>> >>> That is what makes doing the close wrong. >>> But that is a program aggressively trying to hit the timing window, >>> not a normal program that has managed to pass an invalid pointer. >>> The most likely reason for a real program passing an invalid pointer >>> is a corrupted heap (assuming the stupid coding errors are fixed). >>> >>> It is really no different from the sockopt code that receives >>> SCM_RIGHTS messages. >>> In that case once you've removed the FILE from the socket (or similar) >>> you really don't want to have to put it back because the write to the >>> sockopt buffer or length field fails. >>> The chance of correctly reverting the kernel state is small - and won't >>> be tested. >>> >>> David >>> >>> > >>> > The fix itself is small and follows the standard kernel idiom: >>> > get_unused_fd_flags() reserves the fd without publishing it, so the >>> > window between reservation and install is entirely under kernel control. >>> > >>> > Baineng >>> > >>> > David Laight <david.laight.linux(a)gmail.com> 于2026年7月14日周二 21:14写道： >>> > >>> > > On Tue, 14 Jul 2026 19:46:53 +0800 >>> > > Baineng Shou <shoubaineng(a)gmail.com> wrote: >>> > > >>> > > > DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the >>> > > > caller's fd table via dma_buf_fd() -> fd_install() before >>> > > > dma_heap_ioctl() copies the result back to userspace. If the trailing >>> > > > copy_to_user() fails, userspace never learns the fd number, but the >>> > > > fd (and the underlying dma-buf reference) are already visible to >>> > > > other threads in the same process and are leaked for the lifetime of >>> > > > the process. >>> > > > >>> > > > The obvious "close it on the failure path" fix is unsafe: once >>> > > > fd_install() has run, another thread can already dup() the fd, send >>> > > > it via SCM_RIGHTS, or close() it and let its number be reused, so a >>> > > > subsequent close_fd() from the ioctl path can operate on an unrelated >>> > > > file. This was pointed out by Christian König on v1 [1]. >>> > > ... >>> > > >>> > > My 2c: >>> > > >>> > > The other option is just to leave it as a 'problem for user space'. >>> > > No reasonable program is going to handle the EFAULT return by doing >>> > > anything other than exiting. >>> > > Even getting an EFAULT is really an indication that the application >>> > > is already in a real mess - most likely with a badly corrupted heap. >>> > > >>> > > Anything else leaves error recovery code in the kernel that is pretty >>> > > much never executed and open to a variety of bugs. >>> > > While the recovery here is probably ok, there are some sockopt calls >>> > > where it is all more complicated. >>> > > >>> > > David >>> > > >>>

55 minutes

by homesforyou28＠gmail.com

watsap:+237679457696 The Breeky 200mcg tablets Dubai (_/¯_/¯_/¯watsap:+237679457696_/¯_/¯_/¯ Plan B Kit _/¯_/¯Abu Dhabi, (Uae) Ajman, Sharjah, Al ain, Al barsha Abortion pill Abu Dhabi DubaiThe Breeky 200mcg tablets Dubai (watsap:+237679457696)Buy Abortion pills in riyadh% #jeddah, %dammam, @medina,riyadh saudi arabia?] watsap:+237679457696 __?***?]”Abortion Pills For Sale In kuwait abortion pills in Kuwait watsap:+237679457696, Buy Mtp Kit In Kuwait watsap:+237679457696, watsap:+237679457696 buy Mifepristone and misoprostol online In Kuwait, watsap:watsap:+237679457696 Abortion Pills For Sale In Dubai, watsap:+237679457696 Abortion Pills In Dubai, watsap:+237679457696 Misoprostol Medicine Available In Dubai, Mifepristone Tablets In Abu Dhabi, watsap:+237679457696 Abortion Pills For Sale In Abu Dhabi, watsap:+237679457696 Abortion Pills In Abu Dhabi, watsap:+237679457696 Misoprostol Medicine Available In Abu Dhabi, Mifepristone Tablets In Abu Dhabi,watsap:+237679457696 Abortion Pills For Sale In Sharjah, +237679457696 Abortion Pills In Sharjah, watsap:+237679457696 Misoprostol Medicine Available In Sharjah, Mifepristone Tablets In Sharjah, watsap:+237679457696 Abortion Pills For Sale In Al Ain, watsap:+237679457696 Abortion Pills In Al Ain, watsap:+237679457696 Misoprostol Medicine Available In Al Ain, Mifepristone Tablets In Al Ain, watsap:+237679457696 Abortion Pills For Sale In Fujairah, watsap:+237679457696 Abortion Pills In Fujairah, watsap:+237679457696 Misoprostol Medicine Available In Fujairah, Mifepristone Tablets In Fujairah, watsap:+237679457696 Abortion Pills For Sale In Ras Al Khaimah, watsap:+237679457696 Abortion Pills In Ras Al Khaimah, watsap:+237679457696 Misoprostol Medicine Available In Ras Al Khaimah, Mifepristone Tablets In RAs Al Khaimah, watsap:+237679457696 Abortion Pills For Sale In Doha, +237679457696 Abortion Pills In Doha, watsap:+237679457696 Misoprostol Medicine Available In Doha, Mifepristone Tablets In Doha, watsap:+237679457696 Abortion Pills For Sale In Qatar, +237679457696 Abortion Pills In Qatar, watsap:+237679457696 Misoprostol Medicine Available In Qatar, Mifepristone Tablets In Qatar, watsap:+237679457696 Abortion Pills For Sale In Bahrain, watsap:+237679457696 Abortion Pills In Bahrain, watsap:+237679457696 Misoprostol Medicine Available In Bahrain, Mifepristone Tablets In Bahrain, watsap:+237679457696 Abortion Pills For Sale In Muscat, watsap:+237679457696 Abortion Pills In Muscat, watsap:+237679457696 Misoprostol Medicine Available In Muscat, Mifepristone Tablets In Muscat, watsap:+237679457696 Abortion Pills For Sale In Oman, watsap:+237679457696 Abortion Pills In Oman, watsap:+237679457696 Misoprostol Medicine Available In Oman, Mifepristone Tablets In Oman,

3 hours, 2 minutes

by homesforyou28＠gmail.com

18 hours, 52 minutes

by homesforyou28＠gmail.com

18 hours, 52 minutes

by homesforyou28＠gmail.com

18 hours, 52 minutes

by homesforyou28＠gmail.com

18 hours, 52 minutes

by homesforyou28＠gmail.com

The Breeky 200mcg tablets Dubai (_/¯_/¯_/¯+971568044699_/¯_/¯_/¯ Plan B Kit _/¯_/¯Abu Dhabi, (Uae) Ajman, Sharjah, Al ain, Al barsha Abortion pill Abu Dhabi DubaiThe Breeky 200mcg tablets Dubai abortion pills in Kuwait+971568044699, Buy Mtp Kit In Kuwait +971568044699, +971568044699 buy Mifepristone and misoprostol online In Kuwait, +971568044699 Abortion Pills For Sale In Dubai, +971568044699 Abortion Pills In Dubai, +971568044699 Misoprostol Medicine Available In Dubai, Mifepristone Tablets In Abu Dhabi, +971568044699 Abortion Pills For Sale In Abu Dhabi, +971568044699 Abortion Pills In Abu Dhabi, +971568044699 Misoprostol Medicine Available In Abu Dhabi, Mifepristone Tablets In Abu Dhabi,+971568044699 Abortion Pills For Sale In Sharjah, +971568044699 Abortion Pills In Sharjah, +971568044699 Misoprostol Medicine Available In Sharjah, Mifepristone Tablets In Sharjah, +971568044699 Abortion Pills For Sale In Al Ain, +971568044699 Abortion Pills In Al Ain, +971568044699 Misoprostol Medicine Available In Al Ain, Mifepristone Tablets In Al Ain, +971568044699 Abortion Pills For Sale In Fujairah, +971568044699 Abortion Pills In Fujairah, +971568044699 Misoprostol Medicine Available In Fujairah, Mifepristone Tablets In Fujairah, +971568044699 Abortion Pills For Sale In Ras Al Khaimah, +971568044699 Abortion Pills In Ras Al Khaimah, +971568044699 Misoprostol Medicine Available In Ras Al Khaimah, Mifepristone Tablets In RAs Al Khaimah, +971568044699 Abortion Pills For Sale In Doha, +971568044699 Abortion Pills In Doha, +971568044699 Misoprostol Medicine Available In Doha, Mifepristone Tablets In Doha, +971568044699 Abortion Pills For Sale In Qatar, +971568044699 Abortion Pills In Qatar, +971568044699 Misoprostol Medicine Available In Qatar, Mifepristone Tablets In Qatar, +971568044699 Abortion Pills For Sale In Bahrain, +971568044699 Abortion Pills In Bahrain, +971568044699 Misoprostol Medicine Available In Bahrain, Mifepristone Tablets In Bahrain, +971568044699 Abortion Pills For Sale In Muscat, +971568044699 Abortion Pills In Muscat, +971568044699 Misoprostol Medicine Available In Muscat, Mifepristone Tablets In Muscat, +971568044699 Abortion Pills For Sale In Oman, +971568044699 Abortion Pills In Oman, +971568044699 Misoprostol Medicine Available In Oman, Mifepristone Tablets In Oman,

18 hours, 58 minutes

by homesforyou28＠gmail.com

18 hours, 59 minutes

by homesforyou28＠gmail.com

19 hours

by homesforyou28＠gmail.com

19 hours

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig