Re: [PATCH 6.12.y 2/2] misc: fastrpc: don't publish fd before copy_to_user() succeeds

[Greg KH <greg@kroah.com>]

On Thu, Sep 10, 2026 at 11:55:46AM -0400, Sasha Levin wrote:
> From: Baineng Shou <shoubaineng@gmail.com>
> 
> [ Upstream commit a4a1a2bfcb29785292d634d7787edc6fb550714d ]
> 
> fastrpc_ioctl_alloc_dmabuf() calls dma_buf_fd() which installs the fd
> into the caller's fd table before copy_to_user() copies the fd number
> back to userspace.  If copy_to_user() fails, the fd is already visible
> to other threads in the same process but the ioctl returns -EFAULT.
> The existing comment in the code even acknowledges the problem:
> 
>   "The usercopy failed, but we can't do much about it, as dma_buf_fd()
>    already called fd_install()..."
> 
> Now that dma_buf_fd_install() is available (introduced to fix the same
> issue in dma-heap), apply the same pattern here: reserve the fd with
> get_unused_fd_flags(), attempt copy_to_user(), and only on success call
> dma_buf_fd_install() to publish it atomically with the tracepoint.  On
> copy_to_user() failure, put_unused_fd() and dma_buf_put() cleanly
> unwind without any user-visible side effects.
> 
> Fixes: 6cffd79504ce ("misc: fastrpc: Add support for dmabuf exporter")
> Cc: stable@vger.kernel.org
> Acked-by: Christian König <christian.koenig@amd.com>
> Acked-by: Sumit Semwal <sumit.semwal@linaro.org>
> Signed-off-by: Baineng Shou <shoubaineng@gmail.com>
> Link: https://lore.kernel.org/r/20260817050457.1005285-3-shoubaineng@gmail.com
> Signed-off-by: Christian König <christian.koenig@amd.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/misc/fastrpc.c | 16 ++++++----------
>  1 file changed, 6 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index 576cd9e5b8079..f09702eaa3915 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -1682,24 +1682,20 @@ static int fastrpc_dmabuf_alloc(struct fastrpc_user *fl, char __user *argp)
>  		return err;
>  	}
>  
> -	bp.fd = dma_buf_fd(buf->dmabuf, O_ACCMODE);
> +	bp.fd = get_unused_fd_flags(O_ACCMODE);
>  	if (bp.fd < 0) {
>  		dma_buf_put(buf->dmabuf);
> -		return -EINVAL;
> +		return bp.fd;
>  	}
>  
>  	if (copy_to_user(argp, &bp, sizeof(bp))) {
> -		/*
> -		 * The usercopy failed, but we can't do much about it, as
> -		 * dma_buf_fd() already called fd_install() and made the
> -		 * file descriptor accessible for the current process. It
> -		 * might already be closed and dmabuf no longer valid when
> -		 * we reach this point. Therefore "leak" the fd and rely on
> -		 * the process exit path to do any required cleanup.
> -		 */
> +		put_unused_fd(bp.fd);
> +		dma_buf_put(buf->dmabuf);
>  		return -EFAULT;
>  	}
>  
> +	dma_buf_fd_install(buf->dmabuf, bp.fd);
> +
>  	return 0;
>  }
>  
> -- 
> 2.53.0
> 
> 

breaks the build :(