mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-11 12:34:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test

Browse Source 
Add a test case that verifies no file descriptor is leaked when
DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails
to deliver the fd number back to userspace.

The failure is triggered by placing the ioctl argument in a private
anonymous page and flipping it to PROT_READ (via mprotect) between
the kernel's copy_from_user() and copy_to_user() calls.  With the
buggy kernel the ioctl returns -EFAULT but leaves an extra open fd
in the process's fd table; with the fixed kernel the fd count is
unchanged.

This serves as a regression test for:
  "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds"

Suggested-by: Sumit Semwal <sumit.semwal@linaro.org>
Reviewed-by: T.J. Mercier <tjmercier@google.com>
Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
Link: https://lore.kernel.org/r/20260817050457.1005285-5-shoubaineng@gmail.com
Signed-off-by: Christian König <christian.koenig@amd.com>
This commit is contained in:
Baineng Shou
2026-08-17 13:04:57 +08:00
committed by Christian König
parent 3e164bf592
commit 8985cbc927
1 changed files with 112 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c
View File

@@ -390,6 +390,116 @@ static void test_alloc_errors(char *heap_name)
close(heap_fd);
}
/*
* count_open_fds - return the number of open file descriptors.
*
* The fd opened by opendir() itself is counted, but since it is opened
* and closed within each call, it cancels out when comparing two counts.
* Returns -1 on error.
*/
static int count_open_fds(void)
{
DIR *d = opendir("/proc/self/fd");
struct dirent *de;
int count = 0;
if (!d)
return -1;
while ((de = readdir(d)))
if (de->d_name[0] != '.')
count++;
closedir(d);
return count;
}
/*
* test_alloc_no_fd_leak_on_efault - verify no fd is leaked when
* copy_to_user() fails during DMA_HEAP_IOCTL_ALLOC.
*
* The bug: dma_buf_fd() called fd_install() before copy_to_user().
* If copy_to_user() then failed (e.g. via mprotect), the fd was
* silently installed in the fd table but never returned to userspace.
*
* The fix: reserve the fd with get_unused_fd_flags() first, attempt
* copy_to_user(), and only call fd_install() on success.
*
* We trigger the failure by placing the ioctl argument in a private
* anonymous page and flipping it to PROT_READ before the ioctl.
* Inside the kernel, copy_from_user() reads from the page (reads are
* allowed under PROT_READ, so it succeeds), but copy_to_user() that
* writes the fd number back faults, returning -EFAULT. We then
* count open file descriptors before and after; with the bug an extra
* fd is left in the table.
*/
static void test_alloc_no_fd_leak_on_efault(char *heap_name)
{
int heap_fd = -1;
int fd_before, fd_after;
int ret;
long page_size;
struct dma_heap_allocation_data *req;
ksft_print_msg("Testing fd leak when copy_to_user() fails:\n");
heap_fd = dmabuf_heap_open(heap_name);
page_size = sysconf(_SC_PAGESIZE);
/*
* Place the ioctl argument in its own private anonymous page so
* we can flip its protection independently.
*/
req = mmap(NULL, page_size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (req == MAP_FAILED) {
ksft_test_result_fail("mmap failed: %s\n", strerror(errno));
goto out;
}
memset(req, 0, sizeof(*req));
req->len = page_size;
req->fd_flags = O_RDWR | O_CLOEXEC;
fd_before = count_open_fds();
if (fd_before < 0) {
ksft_test_result_fail("count_open_fds: %s\n", strerror(errno));
munmap(req, page_size);
goto out;
}
/*
* Make the page read-only so copy_to_user() will fault. The
* ioctl must fail with -1; if it returns success the test setup
* is broken (mprotect is synchronous, so there is no race).
*/
mprotect(req, page_size, PROT_READ);
ret = ioctl(heap_fd, DMA_HEAP_IOCTL_ALLOC, req);
/* Re-allow writes so munmap can clean up */
mprotect(req, page_size, PROT_READ | PROT_WRITE);
munmap(req, page_size);
if (ret != -1) {
ksft_test_result_fail("ioctl returned %d, expected -1 EFAULT\n",
ret);
goto out;
}
fd_after = count_open_fds();
if (fd_after < 0) {
ksft_test_result_fail("count_open_fds: %s\n", strerror(errno));
goto out;
}
ksft_test_result(fd_before == fd_after,
"fd leak on EFAULT: before=%d after=%d\n",
fd_before, fd_after);
out:
close(heap_fd);
}
static int numer_of_heaps(void)
{
DIR *d = opendir(DEVPATH);
@@ -420,7 +530,7 @@ int main(void)
return KSFT_SKIP;
}
ksft_set_plan(11 * numer_of_heaps());
ksft_set_plan(12 * numer_of_heaps());
while ((dir = readdir(d))) {
if (!strncmp(dir->d_name, ".", 2))
@@ -435,6 +545,7 @@ int main(void)
test_alloc_zeroed(dir->d_name, ONE_MEG);
test_alloc_compat(dir->d_name);
test_alloc_errors(dir->d_name);
test_alloc_no_fd_leak_on_efault(dir->d_name);
}
closedir(d);