On Wed, Jul 29, 2026 at 11:27 PM Baineng Shou shoubaineng@gmail.com wrote:
Add a test case that verifies no file descriptor is leaked when DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails to deliver the fd number back to userspace.
The failure is triggered by placing the ioctl argument in a private anonymous page and flipping it to PROT_READ (via mprotect) between the kernel's copy_from_user() and copy_to_user() calls. With the buggy kernel the ioctl returns -EFAULT but leaves an extra open fd in the process's fd table; with the fixed kernel the fd count is unchanged.
This serves as a regression test for: "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds"
Suggested-by: Sumit Semwal sumit.semwal@linaro.org Signed-off-by: Baineng Shou shoubaineng@gmail.com
.../selftests/dmabuf-heaps/dmabuf-heap.c | 115 +++++++++++++++++- 1 file changed, 114 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c index fc9694fc4e89..bd58e5b06c8b 100644 --- a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c +++ b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c @@ -390,6 +390,118 @@ static void test_alloc_errors(char *heap_name) close(heap_fd); }
+/*
- test_alloc_no_fd_leak_on_efault - verify no fd is leaked when
- copy_to_user() fails during DMA_HEAP_IOCTL_ALLOC.
- The bug: dma_buf_fd() called fd_install() before copy_to_user().
- If copy_to_user() then failed (e.g. via mprotect), the fd was
- silently installed in the fd table but never returned to userspace.
- The fix: reserve the fd with get_unused_fd_flags() first, attempt
- copy_to_user(), and only call fd_install() on success.
- We trigger the failure by placing the ioctl argument in a page,
- flipping it to PROT_READ between copy_from_user and copy_to_user,
- and counting open file descriptors before and after.
- */
+static void test_alloc_no_fd_leak_on_efault(char *heap_name) +{
int heap_fd = -1;int fd_before, fd_after;int ret;long page_size;struct dma_heap_allocation_data *req;ksft_print_msg("Testing no fd leak when copy_to_user() fails:\n");heap_fd = dmabuf_heap_open(heap_name);page_size = sysconf(_SC_PAGESIZE);/** Place the ioctl argument in its own private anonymous page so* we can flip its protection independently.*/req = mmap(NULL, page_size, PROT_READ | PROT_WRITE,MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);if (req == MAP_FAILED) {ksft_test_result_fail("mmap failed: %s\n", strerror(errno));goto out;}memset(req, 0, sizeof(*req));req->len = page_size;req->fd_flags = O_RDWR | O_CLOEXEC;/* Count open fds before the ioctl */fd_before = 0;{DIR *d = opendir("/proc/self/fd");struct dirent *de;if (!d) {ksft_test_result_fail("opendir /proc/self/fd: %s\n",strerror(errno));munmap(req, page_size);goto out;}while ((de = readdir(d)))if (de->d_name[0] != '.')fd_before++;closedir(d);/* subtract the fd opened by opendir itself */
But no actual subtraction?
}/** Make the page read-only: copy_from_user() in the kernel will* still succeed (it already ran),
Huh? copy_from_user hasn't run yet. That happens inside the ioctl().
but copy_to_user() that writes
* the fd number back will fault.*/mprotect(req, page_size, PROT_READ);ret = ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, req);/* Re-allow writes so munmap can clean up */mprotect(req, page_size, PROT_READ | PROT_WRITE);munmap(req, page_size);if (ret != -1 || errno != EFAULT) {
This looks like you meant &&, but I think we should just fail if ret != -1. Either the mprotect is broken, or dma-heap didn't actually try to copy_to_user.
/** If the ioctl didn't fail with EFAULT, either the kernel* handled it differently or mprotect raced.
mprotect is synchronous, how could it race with anything here?
Skip rather
* than giving a false pass/fail.*/ksft_test_result_skip("ioctl did not return EFAULT (ret=%d errno=%d), skipping\n",ret, errno);goto out;}/* Count open fds after the failed ioctl */fd_after = 0;{DIR *d = opendir("/proc/self/fd");struct dirent *de;if (!d) {ksft_test_result_fail("opendir /proc/self/fd: %s\n",strerror(errno));goto out;}while ((de = readdir(d)))if (de->d_name[0] != '.')fd_after++;closedir(d);}ksft_test_result(fd_before == fd_after,"no fd leak on EFAULT: before=%d after=%d\n",
This is for the failure case, so I don't think the "no" should be in the string.
fd_before, fd_after);+out:
close(heap_fd);+}
static int numer_of_heaps(void) { DIR *d = opendir(DEVPATH); @@ -420,7 +532,7 @@ int main(void) return KSFT_SKIP; }
ksft_set_plan(11 * numer_of_heaps());
ksft_set_plan(12 * numer_of_heaps()); while ((dir = readdir(d))) { if (!strncmp(dir->d_name, ".", 2))@@ -435,6 +547,7 @@ int main(void) test_alloc_zeroed(dir->d_name, ONE_MEG); test_alloc_compat(dir->d_name); test_alloc_errors(dir->d_name);
test_alloc_no_fd_leak_on_efault(dir->d_name); } closedir(d);-- 2.34.1