On Fri, Aug 7, 2026 at 3:12 AM Baineng Shou shoubaineng@gmail.com wrote:

Add a test case that verifies no file descriptor is leaked when DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails to deliver the fd number back to userspace.

The failure is triggered by placing the ioctl argument in a private anonymous page and flipping it to PROT_READ (via mprotect) between the kernel's copy_from_user() and copy_to_user() calls. With the buggy kernel the ioctl returns -EFAULT but leaves an extra open fd in the process's fd table; with the fixed kernel the fd count is unchanged.

This serves as a regression test for: "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds"

Suggested-by: Sumit Semwal sumit.semwal@linaro.org Signed-off-by: Baineng Shou shoubaineng@gmail.com

Reviewed-by: T.J. Mercier tjmercier@google.com