mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-09-12 18:53:40 -04:00
8985cbc927
Add a test case that verifies no file descriptor is leaked when DMA_HEAP_IOCTL_ALLOC succeeds internally but copy_to_user() fails to deliver the fd number back to userspace. The failure is triggered by placing the ioctl argument in a private anonymous page and flipping it to PROT_READ (via mprotect) between the kernel's copy_from_user() and copy_to_user() calls. With the buggy kernel the ioctl returns -EFAULT but leaves an extra open fd in the process's fd table; with the fixed kernel the fd count is unchanged. This serves as a regression test for: "dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds" Suggested-by: Sumit Semwal <sumit.semwal@linaro.org> Reviewed-by: T.J. Mercier <tjmercier@google.com> Acked-by: Sumit Semwal <sumit.semwal@linaro.org> Signed-off-by: Baineng Shou <shoubaineng@gmail.com> Link: https://lore.kernel.org/r/20260817050457.1005285-5-shoubaineng@gmail.com Signed-off-by: Christian König <christian.koenig@amd.com>