Re: [PATCH v2] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Bypassing the standard dma_buf_fd() API skips the emission of the trace_dma_buf_fd tracepoint.
--

--- Patch [1]: [PATCH v2] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds ---
commit 869904722955c74d0c6e8c974d3c64c6befabac6
Author: Baineng Shou <shoubaineng@gmail.com>

dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

This commit restructures DMA_HEAP_IOCTL_ALLOC to delay publishing the
file descriptor until after copy_to_user() succeeds. It open-codes the
fd allocation and installation steps instead of using dma_buf_fd() to
prevent an fd leak on copy_to_user() failure.

Link: https://lore.kernel.org/dri-devel/175e98de-f414-47d7-81c1-c0fe0a8f7f62@amd.com/

> diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c
> index 3937dd41bb0f6..983dee947c851 100644
> --- a/drivers/dma-buf/dma-heap.c
> +++ b/drivers/dma-buf/dma-heap.c
[ ... ]
> @@ -175,15 +162,28 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
>  
>  	switch (kcmd) {
>  	case DMA_HEAP_IOCTL_ALLOC:
> -		ret = dma_heap_ioctl_allocate(file, kdata);
> +		dmabuf = dma_heap_ioctl_allocate(file, kdata);
> +
> +		if (IS_ERR(dmabuf)) {
> +			ret = PTR_ERR(dmabuf);
> +			break;
> +		}
> +
> +		fd = ((struct dma_heap_allocation_data *)kdata)->fd;
> +		if (copy_to_user((void __user *)arg, kdata, out_size) != 0) {
> +			put_unused_fd(fd);
> +			dma_buf_put(dmabuf);
> +			ret = -EFAULT;
> +		} else {
> +			fd_install(fd, dmabuf->file);

[Severity: Medium]
By open-coding the fd reservation and installation here instead of using
dma_buf_fd(), does this skip the emission of the trace_dma_buf_fd tracepoint?

If so, observability tools, BPF scripts, and perf tracing relying on
trace_dma_buf_fd to map dmabufs to file descriptors will silently miss all
allocations originating from the dma-heap subsystem.

> +		}
> +
>  		break;
>  	default:
>  		ret = -ENOTTY;
>  		goto err;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710105740.3080070-1-shoubaineng@gmail.com?part=1