On 8/13/26 09:46, Taimuraz Kaitmazov wrote:
> amdxdna_gem_obj_vmap() takes whatever dma_buf_vmap() returns and only
> rejects a NULL vaddr. iosys_map is discriminated by is_iomem, so an
> exporter answering with an I/O mapping leaves a void __iomem pointer in
> abo->mem.kva, which amdxdna_cmd_set_error() memsets and memcpys through.
>
> amdxdna_drm_va_tbl takes a dmabuf_fd, so such a BO can be any exporter's
> buffer. amdgpu cannot reach this: its .pin forces GTT for a non peer to
> peer attachment like ours. An exporter on drm_gem_prime_dmabuf_ops has
> no .pin, and drm_gem_ttm_vmap() answers iomem for a VRAM resident
> object, so an NPU paired with nouveau or radeon does.
>
> Refuse the mapping. vmw_gem_vmap() does the same; unlike that one this
> path is reachable from an unprivileged ioctl, so it does not warn.
>
> Signed-off-by: Taimuraz Kaitmazov <taimuraz(a)kaitmazov.com>
> ---
> drivers/accel/amdxdna/amdxdna_gem.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 1f190b319bb..b66ec9e4828 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c
> @@ -683,10 +683,16 @@ static int amdxdna_gem_obj_vmap(struct drm_gem_object *obj, struct iosys_map *ma
>
> dma_resv_assert_held(obj->resv);
>
> - if (is_import_bo(abo))
> + if (is_import_bo(abo)) {
> ret = dma_buf_vmap(abo->dma_buf, map);
> - else
> + /* Callers use mem.kva as an ordinary kernel address. */
> + if (!ret && map->is_iomem) {
> + dma_buf_vunmap(abo->dma_buf, map);
> + return -EOPNOTSUPP;
> + }
Thanks for the fix. The 'is_iomem' check should be moved to
amdxdna_gem_vmap() to cover all the cases.
Lizhi
> + } else {
> ret = drm_gem_shmem_object_vmap(obj, map);
> + }
> if (ret)
> return ret;
> if (!map->vaddr)
I've gone ahead, added one more rb and pushed the result to drm-misc-fixes.
Thanks for the help,
Christian.
On 8/17/26 07:04, Baineng Shou wrote:
> Several drivers call dma_buf_fd() — which internally calls fd_install()
> — before copy_to_user() returns the fd number to userspace. If
> copy_to_user() fails, the fd is already published in the caller's fd
> table but the ioctl returns an error, so userspace never learns the fd
> number. Worse, the window between fd_install() and copy_to_user()
> allows other threads to observe and manipulate the fd (dup, close,
> SCM_RIGHTS), making any "close it on the failure path" fix unsafe.
>
> The fix is to split the allocation into three steps: reserve an fd with
> get_unused_fd_flags() (not yet visible to other threads), do
> copy_to_user(), and only then publish the fd with fd_install() via the
> new dma_buf_fd_install() helper. On copy_to_user() failure,
> put_unused_fd() + dma_buf_put() cleanly unwind with no user-visible
> side effects.
>
> Patch 1 introduces dma_buf_fd_install() in dma-buf.c (wrapping
> fd_install() together with the DMA_BUF_TRACE call to preserve export
> tracing) and applies the fix to dma-heap.
>
> Patch 2 applies the same fix to fastrpc, which even had a comment
> acknowledging the problem could not be fixed before.
>
> Patch 3 replaces the bare fd_install() in drm_gem_prime_handle_to_fd()
> with dma_buf_fd_install() to restore tracepoint coverage for DRM PRIME
> exports (suggested by Christian König).
>
> Patch 4 adds a selftest to tools/testing/selftests/dmabuf-heaps/ that
> reproduces the fd-leak scenario (mprotect flip before the ioctl) and
> verifies the fd count is unchanged after a failed ioctl (suggested by
> Sumit Semwal).
>
> v1: https://lore.kernel.org/dri-devel/20260703080922.1838362-1-shoubaineng@gmai…
> v2: https://lore.kernel.org/dri-devel/20260710105740.3080070-1-shoubaineng@gmai…
> v3: https://lore.kernel.org/dri-devel/20260714114654.3885457-1-shoubaineng@gmai…
> v5: https://lore.kernel.org/dri-devel/20260730062645.233148-1-shoubaineng@gmail…
> v6: https://lore.kernel.org/dri-devel/20260807101140.1357218-1-shoubaineng@gmai…
>
> Changes in v7:
> - Add Reviewed-by: T.J. Mercier to patch 4 (selftest).
> - Add Acked-by: Sumit Semwal to the whole series.
>
> Changes in v6:
> - Rework the selftest (patch 4) per review: extract a count_open_fds()
> helper, fix the copy_from_user() comment, fail (not skip) when the
> ioctl does not return -1, drop the bogus mprotect-race mention, and
> reword the result message.
>
> Changes in v5:
> - Add selftest (patch 4) reproducing the fd-leak scenario (Sumit Semwal)
>
> Changes in v4:
> - Add patch 3: drm/prime: use dma_buf_fd_install() (Christian König)
> - Add Acked-by: Christian König to patches 1 and 2
>
> Changes in v3:
> - Split into two patches (dma-heap + fastrpc separately)
> - Add dma_buf_fd_install() to preserve trace_dma_buf_fd tracepoint
> - Add fastrpc fix using the new helper (T.J. Mercier)
>
> Baineng Shou (4):
> dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
> misc: fastrpc: don't publish fd before copy_to_user() succeeds
> drm/prime: use dma_buf_fd_install() to preserve export tracing
> selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test
>
> drivers/dma-buf/dma-buf.c | 20 ++++
> drivers/dma-buf/dma-heap.c | 80 ++++++-------
> drivers/gpu/drm/drm_prime.c | 2 +-
> drivers/misc/fastrpc.c | 16 +--
> include/linux/dma-buf.h | 1 +
> .../selftests/dmabuf-heaps/dmabuf-heap.c | 113 +++++++++++++++++-
> 6 files changed, 180 insertions(+), 52 deletions(-)
>
Hi,
On 8/23/26 08:02, Junrui Luo wrote:
> Hi Christian, Alex,
>
> Sorry for the ping. No need to look at the patch itself.
>
> I would just be grateful for a quick word on whether the issue it describes
> is a real one. If not, I will drop it; if it is, should I send a v2?
as far as I can see it is completely nonsense what you try to do here.
The fence_drv references an amdgpu_userq object holds are the ones which the queue potentially waits on.
When the queue is freed up those references must be dropped, but that shouldn't affect fence_drv->fences in any way possible.
What exactly is the leak you are seeing?
Regards,
Christian.
>
> Thanks for your time,
> Junrui Luo
On 8/16/26 17:07, Aravind Thokala wrote:
> Some systems need to load large FPGA configuration images. The FPGA
> subsystem allows loading images from the filesystem, but this requires
> the entire image to be loaded into kernel memory first. For drivers
> that need a DMA-capable buffer for programming, the data is then
> copied again into DMA memory. This creates needless memory pressure
> and delays due to the extra copy.
>
> This series adds dma-buf support that allows userspace to allocate a
> buffer directly from a DMA heap, write the FPGA image into it, and
> pass the file descriptor to the kernel via ioctl — skipping the
> intermediate kernel buffer entirely.
Well when you have a device with limited DMA capabilitiesthen DMA buf heaps doesn't allocate DMA-capable memory for that device either.
So the explanation you give above why this interface might be useful is clearly not correct. The DMA subsystem will still do an additional copy when you try to import the DMA-buf allocated from the heap into this device.
Either you need to define a heap with specific allocation restrictions (e.g. GFP_DMA32) or you allocate the DMA-buf through your fpga device so that dma_alloc_attrs() knows that a certain device needs to access the pages beforehand.
Regards,
Christian.
>
> Userspace flow:
> 1. Allocate buffer from /dev/dma_heap/ (e.g., CMA heap)
> 2. mmap the buffer and write the FPGA image into it
> 3. ioctl(/dev/fpgaX, FPGA_IOCTL_LOAD_DMA_BUF, &dmabuf_fd)
>
> The dma-buf logic is implemented as a separate layer on top of the
> FPGA manager, keeping buffer management separate from the write path.
> Individual FPGA drivers opt in by calling fpga_dmabuf_register().
> ---
> This work is based on the approach discussed in [1].
>
> [1] https://lore.kernel.org/all/20231122053035.3758124-1-nava.kishore.manne@amd…
> ---
> Aravind Thokala (2):
> fpga: Add dma-buf interface for FPGA programming
> fpga: versal: add dma-buf programming support
>
> .../userspace-api/ioctl/ioctl-number.rst | 1 +
> MAINTAINERS | 1 +
> drivers/fpga/Kconfig | 9 +
> drivers/fpga/Makefile | 2 +
> drivers/fpga/fpga-dmabuf.c | 198 ++++++++++++++++++
> drivers/fpga/versal-fpga.c | 33 ++-
> include/linux/fpga/fpga-dmabuf.h | 22 ++
> include/linux/fpga/fpga-mgr.h | 1 +
> include/uapi/linux/fpga.h | 15 ++
> 9 files changed, 281 insertions(+), 1 deletion(-)
> create mode 100644 drivers/fpga/fpga-dmabuf.c
> create mode 100644 include/linux/fpga/fpga-dmabuf.h
> create mode 100644 include/uapi/linux/fpga.h
>
Unlock the Freedom of the Seas with an Italian Boat License – No Test Required!
https://continentaldocs.com
Are you dreaming of navigating the stunning Italian coastline but worried about the hassle of obtaining an Italian boat license? We’ve got great news for you! At our website, we specialize in helping you obtain your Italian boat license without the need for a test. Whether you're a seasoned sailor or just starting, our services are designed to make the process as smooth and fast as possible.
Why Choose an Italian Boat License? https://continentaldocs.com/buy-italian-boat-license/
An Italian boat license is not just a document – it’s your passport to explore the beautiful Mediterranean waters. Whether you're interested in leisurely cruises or more adventurous voyages, having an Italian boat license opens up a world of possibilities. But the process can be daunting, especially for foreigners or those unfamiliar with the requirements. That’s where we come in.
Fast and Easy Italian Boat License – No Test Needed! https://continentaldocs.com/buy-italian-boat-license/
Our service is tailored to provide a fast Italian boat license solution, especially for those who want to skip the lengthy and often difficult exam process. With our assistance, you can buy an Italian boat license online, ensuring that you get your license quickly and without the usual stress.
Key Benefits of Our Italian Boat License Service: https://continentaldocs.com/buy-italian-boat-license/
No Test Required: We streamline the process, offering you an Italian boat license without test requirements.
Fast Processing: Need your license in a hurry? Our service is known for helping you get your Italian boat license quickly.
For Foreigners: We provide specialized support to foreigners looking to obtain an Italian boat license, ensuring all paperwork and requirements are handled efficiently.
Cost-Effective: We offer the cheapest Italian boat license options without compromising on quality or legality.
Wide European Validity: Your Italian boat license is valid throughout Europe, giving you the freedom to sail beyond Italian waters.
How Our Service Works: https://continentaldocs.com/buy-italian-boat-license/
Simple Application Process: Apply for your Italian boat license through our website, where we guide you through every step.
Fast Turnaround: Once your application is submitted, we ensure a fast process so that you receive your license as soon as possible.
Support for Non-EU Residents: We assist non-EU residents in obtaining their licenses, ensuring compliance with all regulations.
Why Buy an Italian Boat License Online? https://continentaldocs.com/buy-italian-boat-license/
When you buy an Italian boat license online through our service, you’re not just purchasing a document. You’re investing in peace of mind. Our service is recognized as one of the most trusted Italian boat license agencies, ensuring that all legalities are covered and that you receive an official Italian boat license.
For those looking to renew their license, we also offer an Italian boat license renewal service, making it easier to maintain your qualifications without the hassle.
Dealing with Revocation, Suspension, or Loss of Your Boat License? We Can Help! https://continentaldocs.com/buy-italian-boat-license/
If you’re facing issues with your Italian boat license, such as revocation, suspension, or even if you've lost it, don’t worry – we’re here to assist you. Our team is experienced in helping clients navigate these challenges quickly and effectively. Whether your license has been revoked or suspended, or if you simply need a replacement for a lost document, we can guide you through the process and help you get back on the water in no time.
Final Thoughts: https://continentaldocs.com/buy-italian-boat-license/
Obtaining an Italian boat license doesn’t have to be a stressful or time-consuming process. With our help, you can skip the test, enjoy a fast Italian boat license, and start sailing the stunning waters of Italy and beyond. Whether you're a foreigner, a non-EU resident, or dealing with a revoked or suspended license, our service is designed to make your dream of owning an Italian boat license a reality.
So why wait? Apply for your Italian boat license today and set sail on your next adventure with confidence! Visit our website to learn more about how we can help you obtain or restore your Italian boat license. https://continentaldocs.com/buy-italian-boat-license/
You may also search for other Boat Licenses like;
German Boat License (Sportbootführerschein) https://continentaldocs.com/buy-german-boat-license/
Austrian Boat License https://continentaldocs.com/purchase-austrian-boat-license/
Spanish Boat License (Licencia de Navegación) https://continentaldocs.com/buy-spainish-boat-license/
Canadian Boat License (Pleasure Craft Operator Card)
United States Boat License (Boating Safety Certificate)
United Kingdom Boat License (RYA Certificate)
Australian Boat License (Recreational Boating License)
French Boat License (Permis Bateau)
https://continentaldocs.com/buy-french-boat-license/
Italian Boat License (Patente Nautica Italiana)
Dutch Boat License (Klein Vaarbewijs)
Swedish Boat License (Förarintyg)
Norwegian Boat License (Båtførerbevis)
Danish Boat License (Speedboat License)
Portuguese Boat License (Carta de Navegador de Recreio)
Greek Boat License (Greek Skipper's License)
Finnish Boat License (Saaristo- ja Rannikkolaivuritutkinto)
Croatian Boat License (Boat Skipper's License)
Turkish Boat License (Amatör Denizci Belgesi)
New Zealand Boat License (Boating Education Certificate)
South African Boat License (Certificate of Competence)
Brazilian Boat License (Carteira de Habilitação de Amador)